Vulnerability Overload: Making Prioritization Work in the Real World

Season 3 - Episode 3

Host: Patrick Miller

Guest: Kylie McCLanahan

In this episode, Patrick Miller speaks with Kylie McClanahan, CTO at Bastazo, about the practical (and often messy) realities of patch and vulnerability management in operational technology (OT) environments. Kylie shares grounded insights into patching challenges, the gaps between IT and OT remediation cycles, and the real-world implications of relying too heavily on scoring systems like CVSS.

The conversation covers CISA’s Known Exploited Vulnerabilities (KEV) catalog, exploring how it’s being used (and possibly misused) in prioritization workflows, and where the disconnects lie between policy directives and operational feasibility. Kylie also critiques the current state of vendor responsiveness, machine-readable vulnerability disclosure (CSAF), and the importance of asset and exposure awareness.

This episode is essential listening for practitioners wrestling with patching fatigue, program prioritization, and the tradeoffs between theoretical vulnerability data and applied security outcomes in critical infrastructure environments.

 

Recent Podcasts

Featured
Vulnerability Overload: Making Prioritization Work in the Real World
Vulnerability Overload: Making Prioritization Work in the Real World

Patrick Miller talks with Kylie McLanahan about the messy reality of vulnerability management in OT environments. They dig into the pressure to patch, standardization benefits of machine readability and the CSAF, the limits of CVSS, and how CISA’s KEV list fits into prioritization efforts. Kylie brings insight from across the ecosystem (vendors, regulators, and asset owners), offering strategies to cut through the noise and focus on what matters most. From patch fatigue to risk-based triage, this episode is packed with practical advice for managing cyber risk when time, tools, and resources are limited.

From CISO to Startup: OT Security, Leadership, and Lessons from the Field
From CISO to Startup: OT Security, Leadership, and Lessons from the Field

In this episode, Patrick Miller interviews Darren Highfill, former CISO of Norfolk Southern, for a candid look behind the curtain of life as a security executive. Darren shares hard-won lessons from building and leading a cybersecurity program in a critical infrastructure environment, including how to gain executive buy-in, scale a team, and align security with business priorities. He reflects on the challenges of translating cyber risk into business risk, managing real-world incidents, and the evolving expectations of the CISO role. Whether you're in the chair now or working toward it, this conversation is packed with practical insights for anyone navigating cybersecurity leadership.

Critical Conversations: IR, Forensics, and Regulation in OT
Critical Conversations: IR, Forensics, and Regulation in OT

In this episode, we sit down with Lesley Carhart (@hacks4pancakes), a renowned expert in OT/ICS incident response and forensics, to explore the unique challenges of defending critical infrastructure against cyber threats. Lesley shares insights into how internal OT teams can better support external IR teams, evaluates global and sector-specific preparedness, and discusses the impact of regulations on effective incident response. We delve into the complexities of defining and reporting incidents, the potential for improved approaches, and actionable advice for those looking to enhance their IR and forensics skills.

Patrick Miller