Soap Box: HD Moore talks OT security, frontier fearmongering and more

The podcast discusses the evolution of RunZero from an IT asset discovery platform into a critical tool for OT and IoT security, driven by the widespread presence of unmanaged industrial devices such as HVAC systems, PLCs, and building management controllers. The acquisition of RunZero by Accenture - alongside OT security firms like Dragos - highlights a strategic convergence of IT and operational technology security. The discussion emphasizes how seemingly minor, internet-exposed devices (e.g., thermostats or cameras) often serve as gateways to more sensitive systems, with vulnerabilities exacerbated by poor network segmentation, default configurations like UPnP, and the use of non-IP protocols such as BACnet and KNX.

A major theme is the growing inadequacy of traditional vulnerability management in the face of rapidly expanding attack surfaces and AI-driven exploitation. With hundreds of thousands of vulnerabilities disclosed annually - many never receiving CVEs - reliance on CVE-based scanning is no longer sufficient. Instead, the focus shifts back to foundational security practices: comprehensive asset discovery, minimizing internet-facing services, and adopting zero trust principles. The conversation also draws parallels between past cybersecurity fears, such as those surrounding Metasploit's release, and current anxieties about AI, arguing that technological advancement cannot and should not be slowed, but rather embraced by defenders through innovation, better tooling, and proactive strategies like honeypots and AI-assisted detection.

• What if you built an AI-powered integration generator for your niche SaaS product?

  • Move: Use open-source LLM tooling (e.g., Ollama, LangChain) to build a feature that ingests API documentation URLs and auto-generates working integration scripts (Python/JS) with error handling and auth patterns. Host it as a free tool on your site.
  • Why Now?: AI can now parse technical docs and generate reliable code fast - what took weeks manually can be done in minutes. Customers expect instant integrations, and competitors still rely on manual dev work or limited pre-built connectors.
  • Expected Upside: Capture inbound leads from developers searching for "how to connect X to Y." Position your product as the easiest-to-integrate solution in your category. Turn the tool into a growth loop: every new integration improves your training data.

• What if you replaced CVE-based vulnerability scanning with real-time asset exposure tracking for unmanaged devices?

  • Move: Build a lightweight scanner (CLI or Docker) that fingerprints internet-facing assets (like HVAC, IP cameras, OT devices), checks for UPnP exposure, and maps hidden internal systems using protocol banners (BACnet, Modbus). Output a risk score and exposure path.
  • Why Now?: Over 200k pending CVEs make patching impossible; attackers exploit unknown paths through unmanaged devices (e.g., Target breach). Public scanners miss non-IP and cellular-connected OT gear. You can fill the gap with targeted, practical detection.
  • Expected Upside: Offer a high-margin security audit service or sell the scanner as a standalone tool to MSPs and red teams. Differentiate by focusing on exposure over vulnerabilities, aligning with Accenture's RunZero acquisition strategy.

• What if you launched a honeypot-as-a-service that detects AI-driven attackers using predictable LLM behavior?

  • Move: Deploy a network of low-interaction honeypots simulating common OT/IoT services (e.g., BACnet gateways, Hikvision cams). Inject subtle traps (e.g., fake login prompts, malformed responses) that trigger telltale patterns when scraped by LLM-powered tools. Log and analyze interaction signatures.
  • Why Now?: AI-assisted attacks are rising but still naive - they repeat queries, fail basic deception, and lack human-like exploration. Most solo devs ignore this detection vector, leaving a first-mover advantage.
  • Expected Upside: Monetize via subscription reports ("AI Attack Alerts") for SMBs or sell intelligence to threat feeds. Use captured tactics to improve your own product defenses. Establish authority in AI-era security with minimal infrastructure cost.

• Audit and remove unnecessary internet-facing services using asset discovery tools to minimize attack surface exposure.
• Implement continuous network discovery to identify unmanaged devices (e.g., IoT, OT) that may lack CVEs but pose critical risks.
• Integrate third-party data (e.g., Shodan) with internal scanning to improve device fingerprinting and detect hidden or misconfigured systems.
• Develop custom AI-assisted integrations for internal tools using documentation-driven automation to streamline monitoring and response workflows.
• Adopt granular role-based access controls (RBAC) with SSO integration to secure API and agent access in self-hosted or cloud environments.