XBOW CISO Nico Waisman on AI-Driven Offensive Security
Summary
XBOW CISO Nico Waisman discusses his career in offensive security, CISO pressures, and his concern that falling AI costs could enable attackers to use autonomously adapting malware at scale.
Key points
- Waisman describes a career spanning offensive security research, open-source security, and CISO roles at Lyft and XBOW.
- He says XBOW built an AI-based product that performs penetration tests autonomously and at scale.
- At Lyft, he saw balancing security with engineering enablement as a central challenge for a CISO.
- He says CISO leadership includes shielding security teams from excessive pressure and burnout.
- Waisman warns that if AI costs fall, attackers could gain a positive return from targeting IPs with autonomously adapting malware at scale; this is his forecast, not a reported attack.
Article Details
- Topic
- Nico Waisman's cybersecurity career and perspectives on AI-driven offensive security, leadership, and CISO burnout
People
Dave AitelFounder of Immunity and a mentor to Waisman, who recalls learning from Aitel to focus on what matters in security.Nico WaismanCybersecurity executive and offensive security researcher; he is CISO at XBOW and previously led security at Lyft and GitHub Security Lab.Oege de MoorFounded Semmle and later co-founded XBOW with Waisman, combining AI and offensive security.
Vendors
GitHubWithin a few months of Waisman joining Semmle, it was acquired by GitHub; and by the end of 2019, Waisman was the senior director of GitHub Security Lab.Immunity“Eventually,” he says, “even in Argentina, the future showed up, and I was able to get a job in cybersecurity.” In 2003 he joined Immunity as a senior security researcher.SemmleAfter 17 years at Immunity, he left to join Semmle in June 2019 as director of research for Latin America.XBOW“So, we built this company called XBOW, and we’ve been in business for two years.
Products
CodeQLWhile at GitHub, Waisman helped his new home adopt and integrate Semmle’s CodeQL.CopilotAfter GitHub was acquired by Microsoft, de Moor led the team that built Microsoft’s Copilot AI.GitHubWithin a few months of Waisman joining Semmle, it was acquired by GitHub; and by the end of 2019, Waisman was the senior director of GitHub Security Lab.