We Cut Security Reviews From 2-3 Days to 10 Minutes With AI | Farzan Karimi | S3 | E2

We Cut Security Reviews From 2-3 Days to 10 Minutes With AI | Farzan Karimi | S3 | E2

by Eva Benn & Farzan Karimi · View the channel on PSI

Humanities, Social Sciences & Thought Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Eva Benn & Farzan Karimi 👥 136K 📅 October 12, 2026 ⏱ 40 min 👁 30 📄 expert opinion 🧭 2026-10-12
Available in: English (current) Français

Keywords

AI in SecurityVulnerability PrioritizationThreat ModelingExploitabilityAttack Chains

Summary

In this interview, host Eva Benn speaks with Farzan Karimi, Deputy CISO at Moderna, about practical applications of AI in cybersecurity. Karimi shares his experience building an internal threat modeling agent that cut review times from 2-3 days to 5-10 minutes, completing 687 reviews in August 2026 and generating over 3,000 risks. He emphasizes that AI should solve a concrete problem, not be deployed for its own sake, and warns against ‘AI snake oil’ where vendors focus on the technology rather than the problem. The conversation moves to vulnerability prioritization: Karimi argues that severity scores (like CVSS) are insufficient and that proving actual exploitability, through pentesting, fuzzing, or continuous agentic testing, must be a modifier on existing data. He suggests shrinking a large backlog by focusing on reachability, sensitive data, and tier-one assets, then proving exploitability for the top 20 items. Karimi also stresses the importance of counting attack chains rather than individual findings, because attackers chain multiple bugs to create critical impact. He explains his work on Recursive Request Exploits (RRE), a new web attack class, and discusses the broader problem of misconfigured Firebase databases discovered through scanning a million domains. The episode concludes with advice to break silos within organizations, since misalignment between security, engineering, and operations often becomes the real risk, and encourages teams to ask their system owners about their assets’ security posture this week.

229 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high, as it comes from a practitioner with deep offensive security experience now in a leadership role. Karimi provides concrete, actionable insights: how to select AI use cases (focus on bottlenecks, repetitive tasks), how to measure AI effectiveness (quality bar, human correction rates, time saved), and how to prioritize vulnerabilities (exploitability as a modifier, reachability, attack chains). His arguments are coherent and grounded in real examples, such as the threat model agent at Moderna and the Android red team’s fuzzing approach. He openly acknowledges the imperfections of early AI deployments, which strengthens credibility. The argumentation is persuasive, but it relies primarily on anecdotal evidence and personal experience rather than systematic comparative studies. The discussion on attack chains offers a fresh perspective on moving from a count-based to a chain-based metric, a concept that aligns with modern threat modeling but is rarely articulated so clearly.

Scientific Rigor, Source Quality, Title Accuracy

The video’s scientific rigor is moderate but acceptable for an expert interview format. The content is based on the speaker’s extensive practical experience, which lends authority, yet no formal references or peer-reviewed sources are cited during the conversation. The description does provide links to related research and articles, including Karimi’s blog posts on RRE and Firebase, the PortSwigger nomination, and a CyberScoop article on AI-powered security tools. These sources add credibility but are not systematically referenced during the talk. The title accurately highlights the main claim of reducing security review times from 2-3 days to 10 minutes, which is directly supported by the described threat modeling agent. The overall presentation is coherent, and the adéquation between title and content is strong, with minimal exaggeration.

289 words

Title / Content Match

The title accurately reflects a key outcome highlighted in the episode — the reduction of security reviews from days to minutes using AI — and the discussion covers this achievement in detail.

Quality & Reliability

8/10

Guest is a highly experienced Deputy CISO with 20+ years in offensive security; practical examples from real deployments; no notable contradictions or unsupported claims. The content is anecdotal rather than systematically peer-reviewed, but it is grounded in concrete experience and specific metrics.

Chapters

Cited Sources

  • How I Accessed 1,800 Company Livestreams and Uncovered a New Web Exploit Class: RRE — Discussion of the recursive request exploit class and the 2020 livestream vulnerability.
  • RRE Burp Suite extension — Tooling for detecting recursive request exploits, mentioned during the technical explanation.
  • I scanned 1 million domains for Firebase misconfigurations — Reference to the Firebase scanning project that found 2,216 exposed databases.
  • The 20-second Firebase demo (LinkedIn) — Video demo of exploiting a misconfigured Firebase database, shared in the show.
  • Collaboration for battling security incidents, LWN.net report — Mention of his SunSecCon 2026 keynote on collaboration in incident response.
  • PortSwigger Top 10 Web Hacking Techniques of 2025, nominations list — The podcast discusses the nomination of RRE for this year's list.
  • Inside the race to adapt to an AI-powered security world, CyberScoop — Referenced in the context of AI snake oil and the need to measure AI value.
  • XBOW's published Moderna customer story — A vendor case study highlighting the use of agentic pentesting at Moderna, consistent with Karimi's remarks.
  • Farzan Karimi's LinkedIn — Guest's professional profile, used to invite discussion and connect.
  • Farzan Karimi's Medium blog (jumpycastle.dev) — Host Karimi's writing on security research, including RRE and Firebase.
  • Farzan Karimi's GitHub — Repository containing security tools and extensions, mentioned in the show.
  • Eva Benn's website — Host's website for follow-up and other cybersecurity resources.

Contribution & Novelties

This episode contributes valuable practitioner insights into how AI can be operationalized in cybersecurity beyond the hype. It presents a concrete, inside look at an internal AI threat modeling agent at Moderna, including measured savings (687 reviews in one month, 6.7 FTEs saved) and the critical role of high-quality input data. The discussion reframes vulnerability prioritization from count-based metrics to exploitability and attack chains, a novel perspective that aligns with modern reasoning about attacker behavior. Additionally, the interview details a new web exploit class (Recursive Request Exploits) with real-world examples and offers a methodology for detecting and mitigating such risks. The emphasis on breaking silos and treating attack chains as the primary metric is a forward-thinking contribution to security program design.

Pour aller plus loin :

210 words

Radar Profile

The radar profile shows strong scores in information quantity (9) and quality (8), indicating a dense and reliable interview. Technical level (7) is solid for a security audience, while overall reliability (7) reflects the expert-based yet anecdotal nature of the content. The balanced shape suggests a well-rounded, informative discussion without major weaknesses.

Reliability 7/10