VulnCon 2025 recap
Kusari CTO Mike Lieberman shares his thoughts after attending the second-annual VulnCon conference.
Michael Lieberman
April 24, 2025
Earlier this month, I had the pleasure of attending (and yes, speaking at!) VulnCon — a four-day deep dive into all things vulnerability management, hosted in Raleigh, North Carolina. Between delivering two talks and a workshop, I got the chance to connect with a broad range of attendees — from hands-on technical practitioners to folks steeped in governance, risk, and compliance. It was great, but it also revealed something important: these two groups need to get together more. One thing that stood out to me is how much the technical folks didn’t understand vulnerabilities as a part of a larger risk assessment while the risk management folks didn’t understand the technical implications of how to address vulnerabilities.
One person echoed a familiar concern from my previous roles: that fixing a vulnerability too quickly is bad because it signals critical due diligence steps were skipped. This may have been true years ago, but nowadays automation makes verification faster — and more reliable. It’s not necessary to have a person manually run a suite of regression tests; many of these can be run in the CI system so that you know the changes work before they’re ever merged into the code base. The mindset needs to shift from needing a human to sign off on changes to needing a human to sign off on the tooling. Brandon Lum and I go into more detail on this idea in our new book, Securing the Software Supply Chain.
This ties into the overarching takeaway for me: risk management, especially as it concerns vulnerabilities, is shifting from an audit exercise to an active process. Risk management personnel were concerned with compliance; if a vulnerability was discovered, they’d fire off an email to a team and say “go fix this.” But the modern organization can do better than this. There’s starting to be an understanding that companies need tools that can identify where vulnerabilities are in the supply chain and who is responsible for addressing them, whether it’s an internal team, a vendor, or an open source project.
This is the sort of capability that the Kusari Platform provides, and I’m excited to have those conversations with folks as they realize the value of our offering. If you want to learn more, sign up for a demo.
Like what you read? Share it with others.
.webp)
.webp)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.jpg)
Previous
No older posts
Next
No newer posts
Want to learn more about Kusari?