“While we have millions of software flaws in any typical tech stack, it's the business processes that introduce some of the most critical vulnerabilities. It's 'here's a list of risk, I'm just going to sign off on them without understanding them.' Or 'I'm going to put my customers' API keys in a ticket.' Or a help desk where everyone who locks themselves out gets the same default 'winter 2026' password reset. It's a process where humans get lazy. It's never going to go away, and no amount of patching is going to fix that.”
sputnikintelligence.com
Asked how a company with decades of legacy systems could reach 'vulnerability zero', the ServiceNow security leader argues that cybersecurity is not only a software-flaw problem but a human-process one.
Michael Freeman, senior director of threat research at ServiceNow, has spent his career finding and exploiting vulnerabilities. Prakash asked how a company with decades of legacy systems gets to vulnerability zero in two years.
I think this is where we need to step back and say we have a lot of really smart people doing AI, but they don't know cybersecurity at all. And they view cybersecurity as a software flaw.
But the reality of it is, while we have millions of software flaws in any of our typical tech stack, it's the business processes that actually introduce some of the most critical vulnerabilities that we have. And it's the, okay, here's a list of risk. I'm just going to go ahead and sign off on them without really truly understanding them. Or, you know, I'm going to put my customers' API keys in a ticket and they not think about it. Or a help desk who has, you know, when users call in because they've locked out their passwords, everybody gets the same default winter 2026 explanation point as a password reset. You got 24 hours to replace it. So it's a process where humans get lazy that they introduce. It's going to never go away. And no amount of hatching is going to fix that.
This is the AI in the AM weekly highlights with my co-host, Prakash Narayanan. I'm Nathan Labenz. The narration is my cloned voice, and we'd love your feedback on what works and what doesn't. Today's episode is brought to you in part by Lovable, the software creation tool that brings ideas to life.…
So my understanding is like the disproof was by example, basically, right? They took one of these problems that were thought to be exponential time hypothesis hard and showed that they can come up with an algorithm for that particular problem that is faster. Therefore,
the hypothesis is false. My understanding generally has been that they're not that much faster. And most people still seem to think between P equals NP and P does not equal NP that it's probably not. In other words, some things will continue to be very hard to do. They just don't seem to fall into…