How to Stay Ahead of Attackers With watchTowr's Ryan Dewhurst

So that's, that's really that that really got me interested. And then, yeah, after that, I, yeah, I played around with that kind of stuff and then never really considered it a career, which I don't think, you know, early 2000s, many people did consider that. That's. Right. A career. So eventually I was living in the UK and noticed that the local university was launching a cyber security undergraduate degree. And as soon as I saw that I was like, wow, that that's for me. Like that, that that course was written for me. So I did every I didn't finish secondary school, so I didn't have any formal education.

So it was a struggle to get in. I had to uncle, it's social engineering, but I had to definitely, yeah, do do work some magic to. I got, I got the professor's e-mail address and explain to him that, hey, I've taught myself Python. You know, I understand how different things work in cybersecurity, you know, like I wrote a script for brute forcing and that kind of thing. And eventually he allowed me onto the course.

And then, yeah, I did A4 four years undergraduate in cybersecurity and and then, yeah, that's when my my career started. Really. That's pretty slick. I like that story. What was that first computer do you remember? It was a Pentium 2. I think it had 200 megahertz of a monster. A monster? Yeah, at the time I was, It was so expensive. My mother was a she's a single mother raising two children here in Spain. And for her it was like, you know, it was a crazy expensive and I was super grateful and it just opened the door like to the world for me, right.

Like being able to speak to people all the way in Australia and interact with them and all this knowledge online just just blew my mind. And to be honest, even today, you know, it's, it's crazy that we have this type of technology. Yeah, it's funny you, you mentioned like how expensive that was. I don't, you know, people that are, you know, I'm older than you, but people that are like sort of in the younger generation that are just coming up now might not like you can go buy a really nice laptop right now for under $1000, like really easily. Or a good Chromebook that'll last you years and years for like $400.00. That Pentium 2, like in 1999 or whatever year that was, was probably like a 1500 or $2000 US machine, maybe more, right? Expensive, yeah.

Mac mini. What do they go for nowadays? Like under 500 bucks, I think. And they're super powerful, right? They're like crazy powerful. If you want to run your, what they call it, crowed bots, the new LLM that people are talking about on Twitter, Mac minis. Yeah, exactly. Yeah, no, I mean, yeah, back then it was, it was a real investment, especially for my mother. And then you didn't have the only have the initial investment of the hardware, right. You had the Internet connection that you had to pay for, which is like, I can't remember which it was like say $0.20 a minute or something. But if you're spending almost 24 hours a day online, it's. Like and.

Plus you probably had to upgrade the RAM yourself like every four months or something to make it keep working. I'm sure. Yeah, yeah. I remember when I first got it, I didn't know how to install software from my from my CDs, like my game cd-roms. But first I just copied the whole contents of the CD-ROM and pasted it like onto my hard drive. That's how I would install it. So I just didn't understand how to how to install the software. I run out of of hard drive space and like, yeah, would be like 2 CDs.

It's crazy. It's funny because there really weren't like it, it wasn't obvious like if you, you had to go and find this stuff out for yourself. And that was part of the joy, I think probably for me for sure, and I'm sure for you was that joy of discovery. You're like, how does this work? Like how do I do this specific thing to go and do the other thing? Like, you know, it was just a, a series of things that you had to, you know, understand before you could do the next thing, you know, like, sort of like the, the hero's journey in a very small way. Definitely.

And I think I think it's different for people growing up today because they're just surrounded by it, right? It's it's like intuitive to them from a young age. I mean, obviously we try not to give the children iPads and that kind of thing, but they're just surrounded by it constantly. So I think you're right. When when I was learning, even just using a mouse like that was a learning curve just to use a mouse, right? It was like it was super difficult. And I remember I did a course, I did like a brief computing course and it was like using Excel or something. And it was just like a huge learning curve at the time, but I'm talking about it earlier, like when I was like 15 years old or something.

I still don't understand how Excel works. I'm getting like. Like. Formulas. To be fair, but have you seen those Excel competitions? They have like crazy competitions. Like yes. I I I just found out about this probably about a year ago here in the US. For whatever reason, it was on like some random cable channel on like a Sunday afternoon and I sat there for like 2 hours fascinated.

I was like, OK, first of all, how is this a competition? What are what are the rules and what are you trying to accomplish? And I was texting all my friends. I was like, have you guys seen this shit? There's people fine. Like. Competing with spreadsheets. It was the wildest shit I've ever seen. Those guys, those, those are the real skilled people in the world. Yeah, Excel competitors for sure. It's like I think about those people that have convinced their parents that, you know, online gaming is a legit profession. Like, you can go and make a lot of money being a professional gamer, right?

But if you go and tell your parents like, I'm the best spreadsheet person in the UK or whatever, like, how is the job? Oh. That's crazy. Yeah. Like your parents not believing it's like a legitimate job. It's like. Right. Yes. Like you try to convince your mom, like, I need this, like, but eventually this will be a job. Like right now it's not really a job, but yeah. Oh, that's funny. It is. It is super useful scale. I mean, we we market, but like Excel can do a lot of yeah, for sure.

Yeah, yeah, I'm glad I don't have to mess with it too much, but yeah, we'll. Need them now. It's pretty so you mentioned like the the kind of like joy of finding out that you could talk to people in Australia or where, you know, all over the world, Spain. Yeah. Was there any sort of like local or any kind of like local hacker scene or folks that you sort of like gravitated towards at that point in the UK? So just to give you a bit of background on my background, so I, I grew up in the site of Spain.

I moved here when I was when I was 2 years old. So my from like 2 to 18 I was, I was here in in the site of Spain, in Malaga specifically. Oh my God, it's one of the most beautiful places on earth. It's nice. Have you been? I have, yeah. It's a nice place. Yeah, it's. Incredible. Of sunshine a year and except this week, like this week's been terrible. But usually so, yeah. So growing up here in the South of, in the South of Spain, there wasn't I, I guess I was desperately, I guess anywhere at that time, you know, there just wasn't that hacker culture or, or I mean, I guess there was, but it was very niche and mostly online.

We really have that thing of meeting up in person. Everyone was like behind a pseudo name. You didn't know the real name. You didn't, didn't know too much about those people. But I think while we're on the topic of, of Malaga, what is interesting is while I was here, I didn't know about this at the time, but like in the early 2000s, a guy called Fernando Quintero, he founded Virus Total here in Malaga, right? And yeah, he, he's, that's obviously since being acquired by by Google.

And Google Now have a huge cyber security presence here in Malaga because of Virus Total. They need a lot of resources here. But yeah, I was completely unaware of that when I was when I was growing up here. And I wish I hadn't known. So that would have been awesome. But then when I moved back to the UK when I was 18, I went to when I went to university studying cyber security. I think they're, yeah, started to become aware of the different communities. So we had small like a WASP chapter meeting not far from from where I went to university.

So I went to a few of those, did a few talks, a few of those events, I think they're called 4200 events as well. So that yeah, we had, we had those kind of local events. We're very small, obviously nothing like you get nowadays. I went to besides London back in December and I, I went to like the second or third ever besides London. I can't remember what year it was, but then going this year, it was just crazy big. Like there's so many people there and you think when you look around and think, wow, you know, and there's all types of different backgrounds, not just cyber security, but people, IT management.

And I met a police officer there and it's just like, wow, this, you know, it's, this is huge now and it has been huge for a while. And I guess with you being in the States, Dennis, I, I, I assume you've been to like black art and Defcon. I've never been to those myself. Many times, yeah. But I can imagine those are yeah, the the B size London. But yeah, I mean, it's incredible how far the industry has come in, in this time and.

Yeah. I, I was talking to B size London with an old friend of mine and we're like, yeah, it's, it's just huge. And we had that when we used to go to B sides. We'd always, every year meet the same people, right? And you have community and then you speak on Twitter together and everyone kind of knew each other. And then nowadays you go to an event and it's like, you know, spot the person that you know, you know, there's not that many that many. Yeah. So I think, I think, yeah, it's, it's, it's a good thing, but it's definitely different, that's for sure. It is different, yeah.

I mean, the first black cat I went to was in 2001, so, you know, 25 years ago now. And there were, I don't know, maybe 1000 people. There were probably not even that, maybe more like 7-6 or 700. And I think I was one of two media people there. And I remember having to like I tracked down, they did have like sort of a press liaison person. There was no Wi-Fi.

You had to have like a, a wired connection, you know, and I was like I was working in a magazine at the time. I was like, how the hell am I going to file stories from here? Like I had to go and find Jeff Moss and he set me up in like their server closet with like a wired Ethernet connection. He's like here, you can sit here for as long as you want to just like hang out and like write your stories or whatever. But, and now you look at Black Hat, there's like 40,000 people there or whatever, you know, it's completely insane. And yeah, trying to find somebody that you know, you're like, oh, OK, I know that person.

Like specifically it's, it's wild. I mean, it's great. Like the expansion of the industry itself in the community, which I think are two separate things. But yeah, it is a little like wild to see just over time, you know, even from year to year. There probably was, as you said it, besides London, like one year where you went back and you're like, oh, holy crap. It like tripled overnight. And especially B sides, right? I mean, originally the London one was set up as like an alternative to like Infosec week, which is like the biggest week in in for cybersecurity. So they set up B sides as like an alternative for, you know, niche, you know, the real sort of security community, not your sales types, but your real hardcore hacker types. And yeah, that's evolved, you know, and the B sides is huge as well, which, which which is really great to see. And there's a lot of, you know, knowledge sharing, a lot of new people in the industry, a lot of

younger generation. So yeah, it's, it's, it's, it's really exciting to see that, that journey and also like where, where is it going to go, right? Like if it's changed that much, like where is this going to be like another 10 or 20 years? I don't know, I feel I talk with my friends about this all the time, like people, you know, kind of around my same age where you just like talk about that evolution that we've seen in, you know, 20 or 25 years. You think just even like 5 or 10 years down the road, like there's got to be some sort of like natural ceiling on it.

But I don't think there is, especially with the I would say, you know, in the last like, let's say 18 months of the way that AI has come in. And you know, I hate talking about AI in general, but the way that it's sort of come in and just seeped into every corner of the industry, you know, not just of like, hey, let's go find bugs in AI tools, but let's build AI tools to find bugs and then let's build AI tools to find bugs and AI tools. And like this whole, you know, sort of like, you know, self fulfilling circle.

Yeah, I mean, there's there's there's definitely a lot of hype are in AI and yeah, I get what you say when you say like you don't talk like talk about it too much because just because there's that much hype, right. But I also think it's super useful. I mean, yeah, as you said, like finding bugs. I mean, there's been A at least a couple of cases now documented cases where it has, you know, found some serious vulnerabilities on a mass scale yet. But yeah, you know, I use I use AI for coding. I think as long as, you know, there's a bit of stigma around using AI for coding, like vibe coding type thing. But I think as long as you have background, some background in programming and you know how to, you know, it's strengths and weaknesses and how to use it properly, I think it's a huge accelerator like it, you know, it can cut down, you know, a month project into maybe a week.

And, and it's something I did use with the first time I used AI for coding projects was with Cyber Muds, a project that I released, I think it was a couple of years ago, about 18 months ago now. And that was the first project where I was like, OK, AI is useful. Like, you know, it's not just the fact that it's not all hype. You can actually build valuable stuff with it. Yeah, I think about it in like a couple of different ways.

Like the way that you described it, using it as sort of an accelerator is like, I already know how to do this thing, but this is going to, you know, make me more efficient at it. Or there's the opposite sort of the other side of that coin of like, I don't really know how to do this, but I'm going to shove a bunch of shit into an LLM and, and hopefully it'll, you know, write this essay for me or, you know, write this, you know, pen test report that I don't feel like writing this weekend. And, you know, that's not great. Like, you need to know how to write in order for this thing to help you write better or more concisely or more clearly. Just I think sometimes it comes up with ideas that, you know, I think, wow, like I would have never thought of that. And it's a really cool idea, you know, like it's like, oh, why don't you try doing this or that in, in this, in this script or the others program.

But there is a risk and I find myself falling into myself like where you get too lazy with it, like where you like, instead of like debugging an error message, you're just like, where did this error come from? Yeah. But yeah, I think it can make you lazy, but I think it is a super powerful tool if you use it in the right way. And yeah, bringing that back to cyber security, I think, I don't think we've seen mass weaponization of it yet.

I think that we've started to see some trickles of it, but I, I do believe we will start to see like mass weaponization of AI in the future. I think right now from, from what I've seen anyway, attackers are using it much the way we are right by coding and as an accelerator then. And we have seen it in some malware to a certain extent, but not, not on a mass scale. But I think we're definitely going in that direction and, you know, maybe this year or definitely next. What form do you think that mass weaponization will take? I mean, I can think of a couple forms, but what do you think is the most likely?

Maybe like polymorphic malware, right? So it's like changing itself based on the environment or it's making decisions based on the environment. You know, like it could, for example work out OK. I mean like a. I'm on a financial network like, OK, what's, what would be the, the crown jewels on this network, right? Where you know what, what kind of data could, could I extract out of this?

I think that in, in terms of mile ways or the mile way itself changing its own code or writing scripts, you know, for lateral movement and that kind of thing. I don't think we're too far off that If we look outside of malware and look at like exploit development, development and vulnerability weaponization, I think again there, it's definitely an accelerator right now. But I think we might get to the point pretty soon where, I mean, it has been done, right.

AI has independently found serious in a couple of cases, yeah. But I imagine a future where AI has all this context of the code, right? As humans, we we work in one file at a time, maybe 2 Max, right? We understand parts of the code. The code may be written by 20 different people. Whereas AI has the advantage, it has all the context at once. And it's not far off where that's going to, you know, start finding vulnerabilities on mass more than what a human is capable of. Yeah, I think the exploit development part of it is one that I think is really interesting because say, you know, given a specific vulnerability in some products, you know how the vulnerability works, but developing the exploit itself is the real time and consuming resource intensive part of that, right?

That's why exploit developers get paid a shit load of money because that stuff's hard, you know, But if, if you can figure out, you know, if there's an AI tool that you can train up to help really do that much more quickly, then we've got real problems. You know, if, I mean, I assume that, you know, the high level APT teams have something like this in their pocket in China and Russia and North Korea. But if that stuff starts making its way into the cybercrime world, which probably isn't too far off, then you know it's going to be really challenging. Yeah.

I mean, I have no doubt that AP, TS and I'd say every threat actor right now is using AI as as much as everyone else's, right? But yeah, we're just going to see more mass adoption of it, and especially as it gets cheaper and more powerful, right? Because it's only getting better and getting cheaper. And even for defenders, that also gives us an advantage, right? It's we're able to analyse vulnerabilities quicker and, and, and which might, may lead to faster patching and, and decision making.

So I think it's, there's definitely two sides of the coin. And I think with everything in cyber security, you know, it's a tool can be used for, for good or bad and well, it will be used for good and bad and, and both will probably accelerate at the same time, right. You know, it's like a an adversary type thing, you know, one up in, one up in each side defence, an attack all the time. So, so yeah, I think the AI stuff, there's a lot of, there's going to be a lot of developments to come for sure.

Yeah, it's, I mean, and it's going to, I think accelerate at sort of a compound pace. Like the more tools are developed, the more, the faster it's going to go. It's already, I mean, it's been like 3 or 4 years since this, these tools really made their way into the public domain in a, in a big way. And look how quickly things have shifted in that time. Yeah, night with AI agents, right. I mean that's that's that's pretty crazy as well. You know, they can go off and actually do stuff. You have a few companies doing it right, like AI pen testing Expo is is I think the worst was known. I'm not sure if they if it's the product is public yet. I know they were at least last time it looked quite closed doors cards to the to the chest type thing, but it's yeah, I mean Expo was on.

I can't remember which book bouncy platform, but you know, it became one of us book cried or hacker one yeah, just showing the effectiveness of of AI and finding vulnerabilities. Of course from the outside. We don't know if that was 100% AI or maybe there was some some human there just verifying. Yeah, we don't know. But if we give them the benefit of the doubt and we can extrapolate to the future, we can see, I think there's always going to be room for a human.

But I can see AI definitely doing most of the work. Yeah. All right. Let me ask you about what you're doing now that I mentioned. You're the director of threat intelligence at Watchtower Labs. What exactly does that entail? I think people, you know, most people understand what threat intelligence is, but like on a daily basis, like what are you doing? Like what's your, what are you looking at? Like what are you trying to understand on a daily basis about the threat landscape? Yeah. So just just to correct you, I'm not the director.

I wish I'm the head. Maybe a promotion? Just take it maybe, maybe if I get a promotion next year, I can be be director. Yeah. So threat intelligence, obviously we're looking at what threat actors are doing right, emerging, emerging in the wild, exploitation. We're looking at emerging vulnerabilities as well. So there's also some vulnerability intelligence in there.

So Watchtower specifically, we have something called Wattower Instinct where we use AI and some algorithms to predict which vulnerabilities are most likely to be exploited in the wild in the future. And then what we can do is we can use that data to proactively ensure that our clients are protected before in the wild exploitation begins. So that's kind of the vulnerability side of things.

On the threat intelligence side of things, obviously we also have our global honeypot network, which is called Attack, right? So we're constantly monitoring. So we have sensors globally and we're constantly monitoring the Internet background noise and making these honeypots, these sensors attractive to different types of attackers, right. So we will put up different types of devices that you would usually see on the edge of enterprise networks, your advantage, your fault in it, that kind of thing.

Yeah. And we and we monitor them and we find, you know, we find attackers exploiting end day vulnerabilities. So they may not be known to be actively exploited yet. So we can, we can say, OK, that's now a, a known exploited vulnerability much like, you know, CC Cav does or, or other, other organizations, or we can look for zero days, right? So have we seen payload come through or maybe an attacker authenticate to one of these devices when they shouldn't have?

And is that a known vulnerability or is that unknown? And if it's unknown, we'll try and reverse engineer what they've used and what they've done. And that feeds back again into our, into our, into our clients, right? So we proactively scan our clients for this kind of thing. And just just to give you an example, what we're seeing now is a lot of the times we're seeing the attackers rather than once they exploit the device, they're not weaponizing that there and then. So we're not taking advantage of that, of that compromise there. And then what they, what they're now starting to do, especially like APT groups is install backdoors, silent backdoors and they'll come back at another time, right? It's convenient.

So what we also do is we monitor for these back doors, web shelves, that kind of thing and scan our our customers for these things to ensure that they they haven't already been compromised by one of these zero days. The that attack timeline to me is always really fascinating because I think in a lot of cases we think of those attacks as a very linear thing of like, OK, they exploited a vulnerability in some edge device, got in 5 minutes later, did this, 10 minutes later, did that, explored the network. And then like an hour and a half later, you know, ransomware detonates or something like that. But as you mentioned, Ryan, like a lot of times it's like days, maybe weeks later, they come back, they've got their web shell there, they've got their back door and they decide, oh, we didn't realize what kind of network this is. This is really valuable.

Let's deploy ransomware, or let's go explore a little more and see what we can pull out of here that's worth something. Yeah, I think, I think there's definitely two sides of it. So when we took like AB, TS and nation states with we're seeing a trend of so they're actively going out and probing for vulnerable devices before their attacks. This is sometimes weeks and months ahead. So we will see spikes in traffic against specific endpoints.

And then what we'll see is the exploitation where they put the back door, silent back door, web shell, whatever that may be. Then they'll come back at a later date and then and then fully take advantage of of that compromise. So that's what we usually see like AP TS, yeah, and nation state actors. But then you have the other side of things where for example, your end days where they're rapidly being weaponized. So from vulnerability being released or patch being released, the it's getting shorter and shorter the amount of time that that exploit is created and weaponized and used against and used against the Internet. So yeah, so I think there's two different sides of that. I think we're definitely seeing attackers move faster vulnerability in patches.

I think traditionally, you know, it could have been weeks or months. And now we're seeing, you know, that came back to days and now we've seen within sometimes within hours. So defenders also have to be a lot faster than they traditionally have been. And perhaps things need to change for defenders to to catch up. So I think right now they're they're they're lagging a little bit behind on on that side of things. Yeah, that's the problem. I mean, defenders, you know, have jobs.

They've got other stuff they have to worry about. They can't always just be like, oh, there's a new, you know, patch out for this device that we have 600 of. Let's get that out right now. They've got meetings, they've got, you know, other things to worry about. The attackers are like, I can just sit here for 12 hours and see if I can find one of these things, you know? Yeah. And there's not only that, but you see attackers weaponizing, say corporate culture. So they will exploit, run, run their mass exploitations on a weekend or, or they'll target the US on an evening or over the holidays. So, yeah, I think attackers are very much aware of the defenders, you know, the the the weaknesses and you know, and they're exploiting that to the Max. I think more and more we're seeing attackers become more targeted and more clever with their attacks and when when they launch, when they launch them trying not to be detected and that and that kind of thing.

Yeah, we always think about, you know, sometime between like the 20th of December and New Year's, there's going to be some big thing, you know, some big attack or some big zero day or like the 4th of July here in the US Everybody just holds their breath for some some nonsense to happen. Yeah. And I think it happened this year, right, with, I think it was, well, there's a couple mainly, but one that springs to mind is, is Mongol bleed was, was over Christmas. And there's a couple of other ones. But, yeah, you know, attackers work around the clock and, and, and, and so do we.

We, you know, we have to, we have to also be aware of that. Yeah. Look around the clock as well. Yeah. I think, you know, the, the zero day disclosure and exploitation by attackers is always one of those things that the security community has been like fascinated with just for, you know, the idea of somebody out there discovered a previously unknown bug and exploited it before we knew about it. You know, the developer of the software or a defender or security company knew about it and did something cool with it. And, you know, we tend to sort of admire that in a in a lot of ways, I think in the security world. But you mentioned a lot of everybody else, you know, that has done this kind of work says, listen, the end days are just as important.

Like it's something that's a month or six months or a year old could be just as valuable to an attacker and just as dangerous to a defender as a zero day that was disclosed yesterday and and maybe more so. Yeah, I, I completely agree. I mean, if you think about it, how much does it cost to in R&D for a zero day, right? I mean, I can only imagine it's at least in the hundreds of thousands, maybe even millions on, on, on certain things. So, you know, attackers or threats is at least work much like a business, right?

They want the highest value for the least cost, right. So, yeah, if they can get away with exploiting an end day from five years ago that cost them literally nothing, then they're going to do that. Yeah. They're also, they're also resource constraint, as the defenders are, and they're always looking for the biggest bang for the buck, the easiest way in. So yeah, definitely there will use end days where where possible and I believe only burn their zero days with absolutely essential right. Yeah, I, I think especially for APT groups that have specific tasks in front of them, you know, they have tasking. If you're a military intelligence APT, they want you to go find these specific things on these specific networks or in these specific organizations.

If you can use some, you know, Avanti's bug from three years ago to get in there, all the better. You know, you didn't have to waste your time trying to find a zero day and find an exploit and all that kind of stuff. You. Know if they explained an advanti from three years ago, they may find other attackers on the same price already. Might be late to the party. Yeah. But but yeah, yeah, definitely. I mean, not only that we saw, you know, if we're not, if we're not just talking about, you know, these big edge fenders, you know, we saw a crazy vulnerability a few weeks ago in town net, right? And then in the new town net which which super simple and had been there for years.

That was wild. I I looked at the date on that advisory like 25 times to make sure it wasn't like from 2004 or something. Yeah, it was just like a flag, right? I can't remember the exact flag with dash F or something. And yeah, it was just like a N bypass. And yeah, it's crazy. And how many you would think. I remember having this argument. There was someone on a forum, this is years ago, like 15 years ago. And I was talking about the vulnerability of townet and someone was like, townet doesn't, no one uses townet anymore.

This is like 10-15 years ago and that's people were saying that with this one like who uses telnet and then actually like there's there's a lot of thousands of telnet still still available on the Internet. Yeah, and things, you know, take a long time to die, especially with like your IoT type stuff, you know, you. Oh yeah, most of those devices aren't. You can't update them. You know, they're meant to die where they where they are in place and then they want you to replace it, right?

So yeah. Yeah. So if you've got a bug in a popular IoT device, you're the king for a couple of years, yeah. Yeah, it's, it's it's crazy. And then you see these devices being used into, you know, DDoS other organizations and that kind of thing. So I mean, that Telnet 1 is a perfect example of how that could be leveraged, you know, to to do like mass DDoS. So yeah, I think, I think attackers, yeah, it may not only be going for like these these edge devices, but there's also these like protocol level or not protocol level. But yeah, these vulnerabilities in, in, you know, very widely used software that may not be just just on on the edge. Obviously the edge if you're looking at your advanties and your fortinets and that kind of thing, that's probably going to give you more valuable data right to an attacker than just spraying like every telnet yeah on Earth. But but yeah, definitely they,

they, you know, we we're getting both end day and and zero day exploitation through Yeah. Yeah. So from a researcher perspective, how do you guys decide where to put your resources like, hey, let's go, you know, look at this specific topic or this specific, you know, product or something along those lines. How do you how do you guys sort of work that out? Yeah. I mean, there's a, there's a few different ways of doing it. I think looking at what our clients have exposed is, is obviously a big one.

Obviously we, we have the labs research team here at Watchtower, which reverse engineer software to find 0 days or, or to weaponize end days, which then goes back into scanning our clients for. So, yeah, so if, if our, if many of our clients are using it, then you know, that's, that's a good target for us to start on. If the exposure on the Internet is, is large, you know, that's another good, good target if we see that attackers have historically had an interest in it. So you've got these these file transfer software that a lot of attackers target a lot, obviously things like, you know, we spoke right.

And then we like, yeah, devices obviously have a lot of valuable data. So just just those kind of things. And sometimes, you know, we might just have a researcher who's like really interested in specific, he just looks researching that and he has a lot of knowledge in it. And, you know, just deep dive into that and we'll allow that freedom. Yeah, for that as well. Yeah, you mentioned the the labs, I think a lot of people listening to this will be familiar with the advisories that Watchtower Labs puts out.

Tell me a little bit, I don't know if how many of these you've been involved in writing, but if nobody, if people haven't read a Watchtower Labs advisory, I encourage you to go do it. Just pick one at random and go and read it and you will be entertained, I promise you. Because this. When you guys started putting those out, it brought me back to like the early 2000s of like independent researchers just putting out snarky, you know, advisories when that first started and just, you know, really not caring.

Very irreverent. And like, I can't believe this bug is here. You guys look, look at this. You know, it's just I anytime I see you guys poke one of those out, it just, it brings me a lot of joy. Yeah, the the, the community really loves our our our blog posts. I've been involved in a few of them. I wouldn't say I can't take credit, that's for sure. Yeah, I've, I've been involved in a few of them. Yeah, and it's huge community love it. We do like to poke fun at vendors because, because at the end of the day, a lot of them deserve it, right? I mean, some of these simple vulnerabilities that we're seeing in these supposed to be security software or maybe the vendor has signed the Secure by Design pledge, for example, We usually find that's a good, that's another good place to actually research anyone who's signed the Secure by Design pledge is a good place to start looking for vulnerabilities we find.

But but yeah, our blog posts, yeah, people love them. We enjoy writing them. We like poking fun, but there's a serious side. Obviously these these probabilities are serious, but but we also like to have a little bit of fun with it for sure. Yeah, you need to. I mean, look what what you all do is, yeah, serious. But at the same time, like as you mentioned, you got into this because it was fun. You thought it was like magic essentially, you know, like, how does this make that happen? Like how can I break something in a cool way and see what the scattered pieces on the floor look like, you know? I, I think really the, the culture of Watchtower comes through the blog post, you know, like that's, that's how we, I would like to think of ourselves. You know, you know, we're playful but high technical and we'd like to, you know, poke fun at vendors who should be doing better for.

Sure. Yeah. One of the things that, you know, maybe the last thing before I let you go that I always think about with your post and others is like, are we learning any lessons like historically from what's happened? Like we as you know, I don't know, software development, like in general, are we building products any better or learning, you know, what mistakes not to make over time? Because you know, we talked about telnet and all these other things. Some of these mistakes just repeat and repeat and repeat and repeat.

And it, it can be a little disheartening if you look at it over the span of time and you're like, good God, this happened in 1999 when you were starting. It's happening in 2026 when we're talking right now. You know, it's, it can be a little, it can be a little discouraging sometimes. Yeah, I think, yeah, I think we're seeing like if we think about, I used to specialize in, in web application security. And if I look back, but when I started doing that, I mean, that was terrible. I mean, we find like SQL injection on the login page and Oh yeah, you know, just pass password dot text file left on the web server and yeah, telnet with admin, admin login. And I find that especially in web application security in that time has improved.

I mean, there's no doubt if I it's been a while since I've done a web application pen test, but I'm sure if I did 1 today, it's not as trivial anymore to find these availabilities like it'd be. It'd be very rare to find SQL injection in a in a login page right nowadays, whereas 1020 years ago almost every login page had SQL injection. I think that's down to more technology and frameworks becoming secure by default, right?

We've got RMS for protect against sequel injection. We've got a lot of default sanitization of of user input. You know, it protects against exercise. We have browsers protecting against exercise as well. So I think I think it is getting better. But then if, if you look on the flip side of that, right, like what happens to these businesses, these big vendors, when, when, when they do mess up, like does anything actually happen to their bottom line, which is what they right.

A business is a money making machine and they're going to put resources where, where there's money's been made. And they're not going to put resources, well, it's not going to make them money, right? So you, you see the, you see these huge breaches and you look at the, the stock price, which is what matters to a business and you may see it dip slightly like the first day or two and then it's back to normal. And in that sense, you, you can't, you can't blame the business for not taking it seriously when it's not hurting the bottom line, right? I mean, this should, this should definitely be doing better. And perhaps the only way is like government legislation at at some level at least or, or to hold. I mean, we, we, we are seeing it. We are seeing government take some steps of fining businesses for not protecting personal information, that kind of thing, at least in, in Europe.

But maybe maybe it needs to be some kind of, yeah, some more liability. You know, it needs to be more serious and then businesses may start taking it more seriously if, if it starts to affect the bottom line in a serious way. Right? Because I don't think not. There's not many examples of where vulnerabilities really hurt a business. It's more the opposite. No, you're right. And I think in a lot of cases, businesses do that very cold calculation of should we spend money on secure software development practices that are going to take a long time and we have to hire a bunch of very smart, very expensive people? Or do we get this product into the market faster and then we can patch it later and almost always time to market wins out? Of course, that's that's what makes money and the big business making machines.

I think what's interesting just to go back to the beginning of the conversation with like vibe coding and and AI, Yeah, like how is that going to affect the number of the, the quality of software in the future, right. Are we going to see more vulnerabilities in software or is AI going to get good enough to detect those before, you know, it's actually deployed? So we're going to see more or less. I think that's up for, at least for me, that's up for debate right now, whether I mean, right now I'd say it's introducing more vulnerabilities than it's stopping.

But if we look like 5 years down the line, are we going to end up with more secure software because of AI or more vulnerable because of just some 15 year old as by code it's something that is better. I think that's up for debate. It could be both. We could end up with, you know, a giant pile of shitty software, which we already have, but like even shitty or as well as stuff that was, you know, somehow made better by some of the AI tools. Yeah, I guess, I guess it's down to the incentives of of the personal team.

That's right. Yes, All right. Yep. And that's. Yeah, I think you're probably right. We're going to see probably what we have now. We have shitty software. We have, yeah, not, not a lot of great examples of good software and it's probably just going to carry on into the future. Yeah, Well, well, that's probably a good place to stop. Ryan, Thanks so much for your time, man. I really enjoyed this. This is great. Yeah, thank you for having me on again, Dennis. And I actually saw you had you had some a lot of great people on here Arsenic Jeremiah Roseman. They're huge heroes of mine when I was growing up. I.

Oh, that's great. I've I've interacted with them a couple of times, you know, and they really respect them and you just had some great guests. So it's really been an honor to to be on the podcast. Thank you, James. Well, it was great having you. Thanks for your time, man. Thank you. Take care.