Jeremiah Grossman
Boise, Hawaii
Cybersecurity. CEO, Root Evidence (@rootevidence) Founded WhiteHat Security, Bit Discovery. Investor. (grossman.vc). BJJ Black Belt.
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jeremiah Grossman
Prioritizing Vulnerabilities by Financial Loss
HomeInterviewsPrioritizing Vulnerabilities by Financial Loss Guests: Jeremiah Grossman, Robert Hansen Hosts: Alan Shimel Category: Interviews Date: October 1, 2026 Evidence based vulnerability management starts with one question. Which flaws actually cost companies money? Alan Shimel welcomes back Jeremiah Grossman, Co-Founder and CEO of Root Evidence, and Robert “RSnake” Hansen, Co-Founder and CTO.
The Solution to Application Security's Biggest Challenge, Vulnerability Remediation, May Finally Arrive
The importance of vulnerability management is simple - find and fix issues before an adversary finds and exploits them. Unfortunately, the remediation rates reported by leading application security vendors average only around 50% or far less. And when vulnerabilities are fixed it takes weeks or months. The rest of the vulnerabilities? They're often never fixed and this has been the reality for many years [ 1] .
The Solution to Application Security’s Biggest Challenge, Vulnerability Remediation, May Finally Arrive
The importance of vulnerability management is simple — find and fix issues before an adversary finds and exploits them. Unfortunately, the remediation rates reported by leading application security vendors average only around 50% or far less. And when vulnerabilities are fixed it takes weeks or months. The rest of the vulnerabilities? They’re often never fixed and this has been the reality for many years [1][2][3][4][5].
WhiteHat - Bit Discovery partnership announcement
Post by Jeremiah Grossman 20 years ago, I founded WhiteHat Security, a company helped pioneer the Application Security industry and revolutionized vulnerability management. Beyond finding and fixing vulnerabilities throughout the SDLC, we saw that the largest and most important problem all of WhiteHat’s customers faced was attack surface management — finding all their websites so they could be scanned.
Security Boulevard
I wanted to get my dad a gift, but not just any gift. The perfect gift. For a diehard hot-rodder like my dad, there can only be one thing — a car. Of course, not just any ol’ thing with four wheels. He quite literally has 50 mostly junkers and clunkers already. Only THE DREAM CAR would do. What kind of car that was I really didn’t know. I had to find out exactly, EXACTLY what that kind of car without letting my dad know and spoil the surprise. For this I asked my brother Zach for help.
Security Boulevard
One might ask why I just didn’t buy an old broken-down Merc and restore it. It’s a fair question. I have helped my dad restore classic cars since I was a kid. However, a 1950 Mercury project like I described would have been very different, a whole other level of cost and difficulty. Believe me, I considered it for years. The shell of body, IF you can somehow find one somewhere in any condition, will still cost $15-20K due to the rarity.
Attack Surface Analysis: 5 Min to Find 50% More Assets
This website use cookies which are necessary to its functioning and required to achieve the purposes illustrated in the privacy policy. To learn more or withdraw consent please click on Learn More. By continued use of this website you are consenting to our use of cookies. WEBINAR March 24th, 2020 | 10 AM PST Did you know that most organizations are missing around 50% of their internet-facing assets?
Security Boulevard
Chief. Information. Security. Officer. The person in charge of protecting an organization’s information assets. The job title sounds so simple, even straight forward, and once upon a time it might have even been an accurate description of the role. It used to be enough to make sure all patches were up to date, network firewalls were in place, intrusion detection set-up, anti-virus installed, and everything on the network properly configured, locked down, and hardened.
Security Boulevard
Below is a working theory on the evolution of The Press in the United States as it relates to their relationship with the government and the people. I expect to continue refining the theory as new perspectives and competing ideas are discussed. TL/DR; The press’s primary value in the system is transmitting a message from the government to the people. The press’s customers are their subscribers who purchase news. Consider the early days of United States of America throughout the late 1700s and 1800s.
Security Boulevard
Over the last two decades the penetration-testing / vulnerability assessment market went through a series of evolutionary waves that went like this… 1st Wave: “You think we have vulnerabilities and want to hire an employee to find them? You’re out of your mind!” The business got over it and InfoSec people were hired for the job. 2nd Wave: “You want us to contract with someone outside the company, a consultant, to come onsite and test our security?
All these vulnerabilities, rarely matter.
There is a serious misalignment of interests between Application Security vulnerability assessment vendors and their customers. Vendors are incentivized to report everything they possible can, even issues that rarely matter. On the other hand, customers just want the vulnerability reports that are to get them hacked. Every finding beyond that is a waste of time, money, and energy, which is precisely what’s happening every day.
Security Boulevard
The biggest and most important unsolved problem in Information Security, arguably all of IT, is asset inventory. Rather, the lack of an up-to-date asset inventory that includes all websites, servers, databases, desktops, laptops, data, and so on. Strange as it sounds, the vast majority of organizations with more than even a handful of websites simply do not know what they are, where they are, what they do, or who is responsible for them.
Security Boulevard
Two years ago, I joined SentinelOne as Chief of Security Strategy to help in the fight against malware and ransomware. I’d been following the evolution of ransomware for several years prior, and like a few others, saw that all the ingredients were in place for this area of cyber-crime to explode. We knew it was likely that a lot of people were going to get hurt, that significant damage could be inflicted, and something needed to be done.
Psychology of Ransomware: How Extortionists Use Fear, Anger and Humor to Hold Your Data Hostage
Over the last year there has been an incredible explosion in ransomware attacks and the security community is getting ready for a very active 2018. No doubt some percentage of the extortionist’s ill-gotten gains will be reinvested to make ransomware tools even better.
Password Cracking AES-256 DMGs and Epic Self-Pwnage - WhiteHat Security
Two weeks ago I was in the midst of a nightmare. I’d forgotten a password. Not just any password. THE password. Without this one password I was cryptographically locked out of thousands and gigabytes worth of files I care about. Highly sensitive and valuable files that include work documents, personal projects, photos, code snippets, notes, family stuff, etc. The password in question unlocks these files from the protection of locally stored AES-256 encrypted disk image.
The Executive Order on Cybersecurity: Can We Finally Get on the Right Path? - SentinelOne
The recent WannaCry campaign took over news cycles, hindering an evaluation of Trump’s recent cybersecurity Executive Order (EO) — but I’ll admit, upon closer scrutiny, it’s a good start. This is particularly true if the goal is to kickstart a national cybersecurity strategy from scratch. As a whole, there are no glaring errors despite some notable omissions, which I will touch on in this post.
I Know Your Name, and Probably a Whole Lot More (Deanonymization via Likejacking, Followjacking, etc.) - WhiteHat Security
Building on the previous section, where we learned a variety of ways that http://maliciouswebsite/ can detect what other websites a browser is logged in to, we’ll move onto the next step — deanonymizing visitors. Deanonymization refers to a website like http://maliciouswebsite/ surreptitiously uncovering a visitor’s full real name.
Why Web Security Is Fundamentally Broken
Most people are disturbed when they witness just how much of their personal information is accessible the very moment they visit a website. Then, if you give that [malicious] website just one mouse-click --- out goes even more personally identifiable data.
Information Security Buzz
Following the news about Yahoo Cyber Indictment Jeremiah Grossman, Chief of Security Strategy at SentinelOne commented below. Jeremiah Grossman, Chief of Security Strategy at SentinelOne: “As I look at the way this story is unfolding, there are strong parallels between this and the Google Aurora attacks in 2010. Nation-state sparring continues playing out on private systems like Yahoo’s because they can provide a valuable source of intelligence on your opponent’s or other people of interest.
False hack attributions carry dangerous risks - The Parallax
You might have heard that Yahoo has been hacked (more than once). So have Sony Pictures, Target, the NSA, the DNC, the IRS, Anthem, Home Depot, and J.P. Morgan, among many others. You’ve likely been hacked too. When people outside the information security bubble learn about major corporate breaches, their immediate thoughts often are, How am I affected this time? Who were the hackers? Why did they do it?
What the Kidnapping & Ransom Economy Teaches Us About Ransomware
Ransomware is center stage, as campaigns are practically guaranteed financial gain. Cyber-criminals profit hundreds of millions of dollars by selling our data back to us. If you look closely, the ransomware economic dynamics closely follow the real-world kidnapping and ransom industry. We’ll explore the eerie similarities, where ransomware is headed, and strategies we can bring to the fight.
Massive Yahoo breach highlights why to hit 'delete' - The Parallax
As you likely have read by now, Yahoo has fallen victim to the biggest user account breach in history. Bob Lord, its chief information security officer, acknowledges that in August 2013, an unauthorized third party stole data associated with more than a billion accounts. This is the latest disclosure of a long string of major security breaches at Yahoo—many of which have come to light in the past few months.
Anti-Malware Is Necessary In The Data Center: 3 Examples
Simply because data center endpoints don't have the same threat profile as general desktops doesn't mean they don't need anti-malware software. Here's why. People often ask about the value of anti-malware software on data center endpoints such as Web servers, databases, file servers - the list goes on.
15 Years of Web Security: The Rebellious Teenage Years
Slideshare uses cookies to improve functionality and performance, and to provide you with relevant advertising. If you continue browsing the site, you agree to the use of cookies on this website. See our User Agreement and Privacy Policy. Slideshare uses cookies to improve functionality and performance, and to provide you with relevant advertising. If you continue browsing the site, you agree to the use of cookies on this website. See our Privacy Policy and User Agreement for details.
The Web Won't Be Safe or Secure until We Break It
The Internet was designed to deliver information, but few people envisioned the vast amounts of information that would be involved or the personal nature of that information. Similarly, few could have foreseen the potential flaws in the design of the Internet—more specifically, Web browsers—that would expose this personal information, compromising the data of individuals and companies.
Browser Security Case Study: Appearances Can Be Deceiving
It seems every day we learn of some new security breach. It's all there for the taking on the Internet—more and more sensitive data every second. As for privacy, we Facebook, we Google, we bank online, we shop online, we invest online... we put it all out there. And just how well protected is all that personally identifiable information? Not very. The browser is our most important connection to the Web, and our first line of defense.
An Insiders Guide to Cyber-Insurance and Security Guarantees
$75 billion. That's the amount of money businesses, governments, and individuals pay every year to security companies. While some security companies provide good value, the reality is the number of incidents are still getting worse and more frequent. Hundreds of millions of people have had their personal information stolen, businesses all over the world are losing intellectual property, and financial fraud is in the billions of dollars.
Ransomware is Here: Fundamentals Everyone Needs to Know
If you’re an IT professional, you probably know at least the basics of ransomware. Instead of using malware or an exploit to exfiltrate PII from an enterprise, bad actors instead find valuable data and encrypt it. Unless you happen to have an NSA-caliber data center at your disposal to break the encryption, you must pay your attacker in cold, hard bitcoins—or else wave goodbye to your PII. Those assumptions aren’t wrong, but they also don’t tell the whole picture.
Making Web Application Security Statistics Meaningful
This year, WhiteHat Security celebrates its fifteenth anniversary in the application security space. Over the years, we’ve witnessed significant change in the web application landscape, including the way apps are connected, the number of applications organizations maintain, both internal and customer-facing, the devices used to access them, the type of data they transport, and the speed at which they are developed.
InfoSec’s Credibility Crisis is also our Biggest Opportunity
Anyone who has been in Information Security for any length of time knows the difficultly of getting people to listen — the frustrating challenge in convincing people to take security seriously. In the enterprise, every single InfoSec budget dollar is painfully scrutinized. Every security decision resisted. Many feel that no matter what InfoSec pros say or do, those they’re responsible for protecting prefer to wait for something bad to happen first.
My last days at WhiteHat and setting sights on the future
I’ve said it many times; the Web is probably the greatest invention we’ll see in our lifetime. The Web touches the lives of everyone we know, every family member, every child, every friend, and everyone we meet. The Web connects over two billion people and fuels entire economies. It’s a place where we learn, communicate, and share our closest kept secrets. Something as important as the Web must be protected and I’ve always felt it was a privilege to do so.
The Greatest Hits of Samy Kamkar, YouTube’s Favorite Hacker
In an age when hackers hire themselves out to organized crime schemes and sell secret intrusion techniques to spy agencies, Samy Kamkar takes a more fun-loving approach to dropping zero-day exploits: YouTube. Kamkar is the one-man production team and star of a video series he calls Applied Hacking, a YouTube channel that has grown into a tour-de-force display of the 30-year-old coder’s prolific digital mischief.
No More Snake Oil: Why InfoSec Needs Security Guarantees
Ever notice how everything in InfoSec is sold “as is”? No guarantees, no warrantees, no return policies. For some reason in InfoSec, providing customers with a form of financial coverage for their … Ever notice how everything in InfoSec is sold “as is”? No guarantees, no warrantees, no return policies. For some reason in InfoSec, providing customers with a form of financial coverage for their investment is seen as gimmicky, but the tides and times are changing.
With Internet Security Broken, We Should Raise the Cost of Attacks
After massive data breaches that affect tens of millions of people, like the recent cyberattacks on JPMorgan Chase and other major banks, I’m commonly asked: “What can average people do to protect themselves?” As a computer security expert, my professional advice is: use hard-to-guess passwords, keep your computer software up-to-date, encrypt your data, and save your backups. But I could have offered the same advice in 2004.
4 Years and 4 Thousand Websites Worth of Vulnerability Assessments: W…
You are reading a preview. Activate your 30 day free trial to continue reading. Citigroup, Sony, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. It doesn't matter if a business is in financial services, retail, education, gaming, social networking, government, telecom, media or travel.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jeremiah
Contact Jeremiah, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack