Signal vs. Noise - The Pulse

The finale of the six-week Measurement series, and a confession: this was never about vulnerabilities.

Vuln triage was the proving ground, the one corner of security where someone already hands you a real exploit probability, so the discipline is easy to see.

But the move underneath it (measure what is expensive, irreversible, and genuinely uncertain, and decide the rest without ceremony) is a leadership posture, not a patching tac...

Last Sunday I opened a paid pilot to help you measure security risk. So here is the whiplash: this week is about when measuring is the wrong move.

That is not me hedging. That is the whole point. A method you reach for every time is not a discipline. It is a tic. What turns measurement into discipline is knowing the decisions that do not earn it, and being willing to say so even when you sell the measuring.

Four times to close the sp...

For three weeks I showed you the method. Shrink forty-seven "criticals" to three. Reorder them by what's actually likely and actually expensive. Say the risk in one sentence a board can hear.

This week, the method stops being something you read and becomes something you can buy.

Three pilot slots. A fixed-scope engagement that takes one decision your team makes by severity alone, vulnerability triage, and rebuilds it on probability a...

A scanner hands a sixty-person firm 312 vulnerabilities, 47 of them flagged "critical," and a five-month queue to clear the reds.

This episode walks the backlog. No new tools, just the discipline at work.

Probability cuts 47 to 6. Asset value cuts 6 to 3.

Then the list reorders. A flaw the scanner rated "Medium" climbs into the final top 3, because the thing most likely to actually hurt the firm was buried in the middle of the pile.

Th...

Microsoft disclosed an Exchange Server zero-day on May 14. A crafted email runs attacker code in your browser session, and it's being exploited right now.

Two of the most qualified bodies in the world scored its severity. One said Medium. One said High. Nearly two points apart on a ten-point scale.

The model that predicts exploitation gives it a 6.3% chance over 30 days. That's the 91st percentile of all known vulnerabilities.

Severit...

CISA added a Linux kernel flaw to its Known Exploited Vulnerabilities list on May 1. CVSS 7.8. Federal agencies got two weeks to patch. Working exploit code in three languages.

The 9.8s your scanner pushed to the top of the dashboard last week were probably nobody's target.

This is the CVSS trap. Severity is not probability. CVSS is not a risk score. And almost every founder-led company has stepped in it.

First episode of a six-week s...

Your AI has a trust model. You didn't write it.

Episode 15 is the audio cut of Pulse #15. Pillar Security disclosed a CVSS 10 in Google's Gemini CLI last month, an exploit chain that started with one public GitHub issue and ended with arbitrary code on the main branch of a Google repo. The same pattern showed up in eight other Google-maintained repos. Host Jane walks through why this isn't a coding flaw, why prompt injection underst...

The compromise isn't the event. It's the precondition.

Episode 14 is the audio cut of Pulse #14. Guardz dropped a number this week that should have stopped every founder's morning: nine in ten SMBs have at least one compromised user account active right now. Not at risk. Active. Host Jane walks through why this isn't a tooling problem (most SMBs already own the tools), why prevention isn't the relevant conversation anymore, and the ...

You bought a product. It's running a process you never designed.

Episode 13 is the audio cut of Pulse #13 — Jim Langevin's decade-old line applied to the thing most boards are still debating. Host Jane walks through why AI coding agents aren't the tool your vendor sold you — they're an autonomous process with network egress, shell access, and more trust than any intern — and why nobody in your org can name the pers...

Your Identity program isn't an Identity problem.

NOTE: Episode numbering matches the Signal vs. Noise newsletter — this podcast launched when the newsletter was at Pulse #12. Audio episodes align one-to-one with newsletter issues.

Episode 12 is the audio cut of Pulse #12 — the cascade argument applied to the one domain that drags nine others down with it.

Host Jane walks through why weak identity quietly pulls AppSec, Inc...

Start here. Episode 0 is the orientation episode — five minutes that lays out the editorial spine for Signal vs. Noise.

Security doesn't fail in silos. It fails in cascades. Host Jane walks through why most security failures trace back to leaders treating complex systems like complicated ones — and why the frameworks that decompose security into independent domains structurally hide the cascades that actually take progra...