Aug 18, 2026 · 36 min · 11 segments
Running a vulnerability scan is easy. Deciding what matters, what is noise, and what a business should do next is the real work. Michael Simmons, founder of Elysium Trace, joins Joe Patti and Adam…
Adam RothHost
Joe PattiHost
And guess what? Those six medium vulnerabilities can actually cause more damage because those six vulnerabilities can lead to a worse situation.
So it really is about how do I give that information to that CRO, that CFO, that CEO, that CXO.
And just to kind of highlight what I, you know, like the main thing I do is like I'm bridging, I'm bridging the enterprise, you know, to the, because we all know that like the small business they use, they use a small open source scanners, right? It's full of noise, right? Yeah.
And I'm like, I was just like, how do I explain this to the, uh, you know, to, to the, uh, executive.
But the, you know, you have the, you have the, um, you know, the big guys and little guys and they're all full of noise.
So even kind of what I've, what I've been, what took me probably about three or four months to do is just like, I've, I was going through my, the results from scanning my own stuff, right.
And just say, okay, well, This is not a true error, right? So I've also came in here with a consultant mindset, things I've seen and things I've done to even pre-get some of those noise, right? My report's not going to spit out 100 different vulnerabilities, right? Because we all know when these scanners pop out something, there's usually a lot of noise you have to sift through.
Right? There's a lot of the things that we, well, from just experience, right? Where it's like, we know it's a false positive, why? Right? And also what I kind of built up with, so pretty much what it is, like with the control pane I built out, I have it where the scan, all that data is in my central portal, right? And if there is something, say you do work for, you know, do work for a small business, right? I actually implemented risk acceptance.
So I definitely took my enterprise-level vulnerability management and the small companies I've worked for and just kind of made something that's in between.
And guess what? Those six medium vulnerabilities can actually cause more damage because those six vulnerabilities can lead to a worse situation.
So it really is about how do I give that information to that CRO, that CFO, that CEO, that CXO.
And just to kind of highlight what I, you know, like the main thing I do is like I'm bridging, I'm bridging the enterprise, you know, to the, because we all know that like the small business they use, they use a small open source scanners, right? It's full of noise, right? Yeah.
And I'm like, I was just like, how do I explain this to the, uh, you know, to, to the, uh, executive.
But the, you know, you have the, you have the, um, you know, the big guys and little guys and they're all full of noise.
So even kind of what I've, what I've been, what took me probably about three or four months to do is just like, I've, I was going through my, the results from scanning my own stuff, right.
And just say, okay, well, This is not a true error, right? So I've also came in here with a consultant mindset, things I've seen and things I've done to even pre-get some of those noise, right? My report's not going to spit out 100 different vulnerabilities, right? Because we all know when these scanners pop out something, there's usually a lot of noise you have to sift through.
Right? There's a lot of the things that we, well, from just experience, right? Where it's like, we know it's a false positive, why? Right? And also what I kind of built up with, so pretty much what it is, like with the control pane I built out, I have it where the scan, all that data is in my central portal, right? And if there is something, say you do work for, you know, do work for a small business, right? I actually implemented risk acceptance.
So I definitely took my enterprise-level vulnerability management and the small companies I've worked for and just kind of made something that's in between.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
