Nico Waisman: Are You Ready for Open-Weight AI Hacks?

Welcome back to Zero Signal! In this episode, hosts Conor Sherman and Stuart Mitchell sit down with Nico Waisman, CISO for XBOW, former CISO for Lyft, and a 17-year veteran at Immunity. As the autonomous pen testing platform that became the first AI to top HackerOne's U.S. leaderboard, XBOW is pushing the boundaries of offensive AI testing. Nico grounds the conversation in the current state of AI-driven exploitation, explaining how open-weight models and custom harnesses are rapidly closing the gap with major foundation models. The discussion dives deep into the realities of vulnerability remediation, unpacking the critical distinction between sheer CVE volume and true exploitability. Nico explores the dangers of unverified AI auto-patching, highlighting research that shows why closed-loop testing and verification are essential before trusting LLM-generated fixes in production. The panel also covers the emergence of agentic threat actors, the strategic resurgence of deception technology and canaries, and how senior security practitioners can leverage memory vaults to scale their offensive testing methodologies. About the Guest Nico Waisman is the CISO at XBOW, the autonomous pen testing firm behind the first AI system to top HackerOne's U.S. leaderboard. He is the former CISO at Lyft and spent 17 years as an offensive security leader and exploit researcher at Immunity. Key Moments The Evolution of Autonomous Offense: From Early CTF Solvers to Top HackerOne Rankings Open-Weight Models in the Wild: Why Adversaries Are Running Local AI Hacking Exploitability as the Ground Truth: Cutting Through CVE Noise with Real Risk Closed-Loop Security & AI Patching: Why Automated Fixes Require Strict Verification Loops Meet our Sponsors Hampton North is the premier US-based cybersecurity search firm: https://hamptonnorth.com/?utm_source=... Sysdig is the leader in AI-powered real-time cloud defense: https://www.sysdig.com/?utm_source=we... RISCPoint Security & compliance consulting tailored to your business: https://www.riscpoint.com/