Uploaded May 2026 | Updated September 2026, 3 hours ago
Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling Fixes from Code to Cloud
Francesco Cipollone (Phoenix Security, GB)
Francesco Cipollone is a renowned entrepreneur and CISO, founder of Phoenix Security, an ASPM platform offering actionable, contextual code-to-runtime insights. A multi-award-winning podcast host, author, and global speaker, Francesco is known for his visionary contributions to cybersecurity. He serves on the UK&I Cloud Security Alliance Chapter board and is a faculty member at IANS on application and cloud security. His insights have appeared in Forbes, Helpnet Security, and Hacker Noon, and he has been featured in prominent podcasts like Application Security Weekly and Cloud Security Podcast. Francesco has keynoted at major conferences such as AppSec Cali and Cyber Security & Cloud Expo, and previously led application and cloud security at HSBC and served as Senior Security Consultant at AWS. An avid marathon runner, snowboarder, and whiskey enthusiast, Francesco balances his professional accomplishments with a passion for adventure and fine spirits.
Exploitation timelines have collapsed. Median time-to-exploit for newly disclosed vulnerabilities is trending toward zero. Attackers are weaponizing CVEs the same day they're published — sometimes before a CVE ID exists. CVE volume is past 380,000 records with 40–48K new entries per year. Scan, triage by CVSS, open a ticket: that workflow is dead.
The bigger shift is in the attack surface itself. Threat actors aren't just exploiting known CVEs. They're publishing backdoored packages on npm, compromising maintainer accounts, deploying self-propagating supply chain worms, and running C2 over blockchain infrastructure that nobody can seize. The Axios maintainer compromise, Sha1-Hulud, TeamPCP — all happened in the last six months. All moved faster than any advisory-based workflow could respond.
The vulnerability lifecycle in a world of agentic AI and automated exploitation has fundamentally changed. Threat intelligence and vulnerability management can't keep running as separate disciplines. CTI and malware intelligence need to feed directly into prioritization. This talk walks through how to do that in practice. I'll cover Phoenix Blue — a free vulnerability intelligence feed aggregating 15+ sources (NVD, CISA KEV, EPSS, Shadowserver, GreyNoise, OpenSSF malicious packages, and more) — and how it powers a threat-centric approach to prioritization. The core of the talk is scoring: how a model that fuses real-time exploitation evidence (honeypot observations, in-the-wild scanning, ransomware associations) with predictive signals (EPSS, Time-to-Exploit cohort patterns, Exploit Acceleration Index) separates the CVEs that are actually burning in production from the ones that just look scary on a report.
We'll dig into reachability analysis — code, library, container, runtime — and why it changes the remediation playbook for containers, where "just upgrade the package" is often wrong, unsafe, or doesn't exist. I'll connect CTI to remediation decisions directly: what's actively dangerous, what's theoretical, what needs compensating controls because patching is slow. And I'll show how agentic LLM enrichment (with dual-model adversarial validation to catch hallucinations) rewrites noisy scanner output into fix-oriented guidance at scale, and how agentic remediation for library upgrades gets dramatically better when you gate it on reachability and production relevance.
The end goal: a CTEM framework on three pillars — ownership attribution, vulnerability attribution, remedy attribution — where every finding is scored by what's being exploited in the real world, not what could theoretically be exploited on paper.
Talk Breakdown:
Exploitation timelines collapsing to zero — the data, the cases, what it means for prioritization workflows
The attack surface moved: malware, supply chain compromise, and threat actor behavior are the problem now, not just CVE counts
Feeding CTI and malware intelligence into the vulnerability pipeline (Phoenix Blue, free, 15+ sources)
Prediction vs. evidence: the dual-signal scoring model and how it separates real threats from noise
Reachability analysis and code-to-cloud tracing for routing fixes to the right team
Container patching: why it's different and how to stop getting it wrong
AI-CTI at scale — agentic LLM enrichment with adversarial validation that catches hallucinations
Agentic remediation for libraries, gated by reachability
CTEM three pillars: right team, right vulnerability, right remedy, right context
What Attendees Walk Away With:
A clear picture of why time-to-exploit at zero changes prioritization fundamentals, and why CVSS on its own was never going to work.
How to wire threat intelligence and malware intelligence into vulnerability management instead of running them as parallel programs.
Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling Fixes from Code to Cloud
Francesco Cipollone (Phoenix Security, GB)
Francesco Cipollone is a renowned entrepreneur and CISO, founder of Phoenix Security, an ASPM platform offering actionable, contextual code-to-runtime insights. A multi-award-winning podcast host, author, and global speaker, Francesco is known for his visionary contributions to cybersecurity. He serves on the UK&I Cloud Security Alliance Chapter board and is a faculty member at IANS on application and cloud security. His insights have appeared in Forbes, Helpnet Security, and Hacker Noon, and he has been featured in prominent podcasts like Application Security Weekly and Cloud Security Podcast. Francesco has keynoted at major conferences such as AppSec Cali and Cyber Security & Cloud Expo, and previously led application and cloud security at HSBC and served as Senior Security Consultant at AWS. An avid marathon runner, snowboarder, and whiskey enthusiast, Francesco balances his professional accomplishments with a passion for adventure and fine spirits.
Exploitation timelines have collapsed. Median time-to-exploit for newly disclosed vulnerabilities is trending toward zero. Attackers are weaponizing CVEs the same day they're published — sometimes before a CVE ID exists. CVE volume is past 380,000 records with 40–48K new entries per year. Scan, triage by CVSS, open a ticket: that workflow is dead.
The bigger shift is in the attack surface itself. Threat actors aren't just exploiting known CVEs. They're publishing backdoored packages on npm, compromising maintainer accounts, deploying self-propagating supply chain worms, and running C2 over blockchain infrastructure that nobody can seize. The Axios maintainer compromise, Sha1-Hulud, TeamPCP — all happened in the last six months. All moved faster than any advisory-based workflow could respond.
The vulnerability lifecycle in a world of agentic AI and automated exploitation has fundamentally changed. Threat intelligence and vulnerability management can't keep running as separate disciplines. CTI and malware intelligence need to feed directly into prioritization. This talk walks through how to do that in practice. I'll cover Phoenix Blue — a free vulnerability intelligence feed aggregating 15+ sources (NVD, CISA KEV, EPSS, Shadowserver, GreyNoise, OpenSSF malicious packages, and more) — and how it powers a threat-centric approach to prioritization. The core of the talk is scoring: how a model that fuses real-time exploitation evidence (honeypot observations, in-the-wild scanning, ransomware associations) with predictive signals (EPSS, Time-to-Exploit cohort patterns, Exploit Acceleration Index) separates the CVEs that are actually burning in production from the ones that just look scary on a report.
We'll dig into reachability analysis — code, library, container, runtime — and why it changes the remediation playbook for containers, where "just upgrade the package" is often wrong, unsafe, or doesn't exist. I'll connect CTI to remediation decisions directly: what's actively dangerous, what's theoretical, what needs compensating controls because patching is slow. And I'll show how agentic LLM enrichment (with dual-model adversarial validation to catch hallucinations) rewrites noisy scanner output into fix-oriented guidance at scale, and how agentic remediation for library upgrades gets dramatically better when you gate it on reachability and production relevance.
The end goal: a CTEM framework on three pillars — ownership attribution, vulnerability attribution, remedy attribution — where every finding is scored by what's being exploited in the real world, not what could theoretically be exploited on paper.
Talk Breakdown:
Exploitation timelines collapsing to zero — the data, the cases, what it means for prioritization workflows
The attack surface moved: malware, supply chain compromise, and threat actor behavior are the problem now, not just CVE counts
Feeding CTI and malware intelligence into the vulnerability pipeline (Phoenix Blue, free, 15+ sources)
Prediction vs. evidence: the dual-signal scoring model and how it separates real threats from noise
Reachability analysis and code-to-cloud tracing for routing fixes to the right team
Container patching: why it's different and how to stop getting it wrong
AI-CTI at scale — agentic LLM enrichment with adversarial validation that catches hallucinations
Agentic remediation for libraries, gated by reachability
CTEM three pillars: right team, right vulnerability, right remedy, right context
What Attendees Walk Away With:
A clear picture of why time-to-exploit at zero changes prioritization fundamentals, and why CVSS on its own was never going to work.
How to wire threat intelligence and malware intelligence into vulnerability management instead of running them as parallel programs.
