Exploit Development, Agentic Vulnerability Discovery, and Fake PoCs

SPEAKER_1 (0:02)

Welcome to the Practical AI Podcast, where we break down the real world applications of artificial intelligence and how it's shaping the way we live, work, and create. Our goal is to help make AI technology practical, productive, and accessible to everyone. Whether you're a developer, business leader, or just curious about the tech behind the buzz, you're in the right place.

Be sure to connect with us on LinkedIn, X, or Bluesky to stay up to date with episode drops, behind-the-scenes content, and AI insights. You can learn more at practicalai.fm. Now, on to the show.

Daniel Whitenack (0:41)

Welcome to another episode of the Practical AI podcast. This is Daniel Wightnack. I am CEO at Prediction Guard, and I'm joined as always by my co-host Chris Benson, who is a principal AI and autonomy research engineer. How are you doing, Chris?

Chris Benson (0:56)

Hey, doing great. Going, going, going. How's it going?

Daniel Whitenack (0:59)

Going, going, going. I mean, Chris, it seems like every day we're hearing about something like this, but today also was a doozy, I guess.

I saw Wall Street Journal article saying, AI discovered exploit that affects 70% of the web, right? This is happening, I guess, as we're recording this October 21st. So we're hearing about this all the time, and it conveniently happened that we had scheduled to talk with us today on the podcast, the Director of Exploit Development at VulnCheck, Spencer McIntyre. Welcome, Spencer.

Spencer McIntyre (1:37)

Hi. Yeah. Thank you for having me.

Daniel Whitenack (1:40)

Yeah, definitely. Well, I know today's events, we may not be able to go into detail because we're still learning all the things, but it is evidence of something that is on the top of everyone's mind, which is how AI intersects with this world of cyber security, particularly around discovering exploits, developing exploits, the offensive-defensive side. Excited to dig in to some of that with you today. But our audience maybe isn't coming from, not everyone's coming from a cyber security background. Could you help us understand a little bit about your background, how you fit into this world? People might find the Director of Exploit Development title rather interesting.

Just to help orient us where do you fit within this world? What are you doing right now with VulnCheck? That sort of thing.

Spencer McIntyre (2:34)

Yeah, absolutely. I was really excited when they offered me the title of Director of Exploit Development.

Daniel Whitenack (2:38)

Pretty awesome.

Spencer McIntyre (2:39)

I thought that was pretty cool. Yeah, it's a pretty cool title. Yeah. Yeah. I've always been really, really passionate about exploits. That's actually how I got into the information security industry. My background started out in consulting, but being very interested in exploit development.

At the time, I was under the impression, this was a long time ago, that you really needed to have a strong background in vulnerability research and have a pocket full of O-days really to get a job as a pen tester, which I would find out then was not necessarily true and is not true now. But that was what I was told. That was how I got started. Then after working in consulting for a while, I slowly transitioned full-time into doing research and development, which has really been my focus over the past 10 years. Some of that overlapped with research and development in consulting, which was really interesting because I got to work with a lot of different organizations in the private sector as well as a few different governments, hospitals, education, detail, hospitality, a bunch of different things.

But then, yeah, I slowly transitioned over to working in research and development full-time. I have an extensive background in the Metasploit Framework, doing module development and things like that. Metasploit was a big part of it and on my journey of doing exploit development that brought me to VulnCheck where, as you mentioned, the Director of Exploit Development and I work on the initial access team, which provides the data for our initial access intelligence feed.

Daniel Whitenack (4:07)

Maybe just to dig into a couple of those terms, just briefly, could you explain maybe Metasploit for those that aren't familiar, and then what you mentioned at the end there around the particular feed that you're plugged into, what that means in the context of VulnCheck.

Spencer McIntyre (4:25)

Yeah, absolutely. Metasploit is a framework for exploit development and penetration testing and vulnerability validation.

At one point, it was the second largest Ruby project, I believe, behind Rails. I don't know if that's still true, but it's a pretty large project. It's been going strong for, I think it celebrated its 21st birthday last year. So a pretty old project at this point, started back in Ruby 1.8. But it was a platform for vulnerability researchers to be able to develop their exploits and share them in a normalized format. This, of course, started quite a while ago.