Principal Threat Hunter

Former NSA chief Nakasone says agency overhaul is 'probably needed' Paul Nakasone said the reported reorganization is likely necessary to meet faster-moving cyberthreats and competition in AI, but warned its success will rest on execution and a workforce facing mounting retirement pressure. October 6, 2026 Former National Security Agency Director Paul Nakasone said a reported broad reorganization of the agency is "probably necessary" as it confronts faster-moving cyberthreats, artificial intelligence and competition with China, but he cautioned that the outcome will depend on how the changes are carried out. Speaking Tuesday at VulnCheck's ThreatCon1 conference, Nakasone addressed a recent report that the NSA is undergoing a major restructuring centered in part on artificial intelligence and China. According to a report last month from the Washington Post, the agency is creating five new organizations focused on artificial intelligence, China, cybersecurity, combat support, and global intelligence, with each led by a newly elevated "mission director." Nakasone, who led the NSA and U.S. Cyber Command from 2018 to 2024, said he found it encouraging that agency leaders recognized the need to adapt. "I think that the world has changed so dramatically, so it's hard to imagine [the NSA] not changing," he said. But he said large-scale institutional changes can take time, especially in an agency with broad intelligence, cyber and military responsibilities. "When you're a big bureaucrat, how effective is that change? I think it depends," Nakasone said. "It's not necessarily the change, because I think that's a good thing. I think it's how you implement the change." Nakasone's comments reflected a central tension in the current national security environment: Intelligence agencies are under pressure to reorganize around emerging technologies, particularly balancing the need to keep the United States as a leader in AI, while also defending against adversaries like China that will look to use the technology for their own strategic goals. He specifically highlighted how AI has sharply reduced the time defenders have to detect and respond to cyber intrusions. When he assumed command in 2018, he said, CrowdStrike data showed that an adversary took hours to move laterally through a system after an initial intrusion. As of 2025, that dwell time has dropped to an average of 29 minutes. "Remember the old mantra, we'd say, 'Hey, we have one minute to be able to recognize something has happened, 10 minutes to figure out what we're going to do, and 60 minutes to really enact it," Nakasone said. "We're well past that, and this is the challenge that we have as we think about our opportunities to have better defense in the future." That attack timeline is particularly significant as organizations are figuring out how AI can be used to defend their networks and systems. Nakasone, who sits on the board of OpenAI, said defenders have a temporary advantage, which he called a "defender's window," before adversaries fully exploit AI's capacity against critical infrastructure and sensitive organizations. "I think there's a defender's window right now within AI that really our adversaries haven't caught up and used the capacity that really could be utilized against our critical infrastructure and most sensitive organizations," he said. The ability to adapt also depends on personnel, Nakasone said, pointing to agencies competing with private companies for technical talent. Citing figures for the government's national security workforce, he said the average age is 47, with half the workforce older than 50, 10% younger than 30 and 13.5% could retire immediately. DefenseScoop reported last week that federal employees in cybersecurity roles could face significant pay cuts. "I think our government has to create the atmosphere that wants to make sure that people see that their work for the government is valued," Nakasone said. "I think that there's probably no one in this room that wouldn't say that we can be more efficient in our government, but I also think there are a lot of people in this room that have had [their] government service attacked to say, 'That's just for people that can't get jobs on the outside.' That's not right. I think there's a way that we can talk much more effectively about our service and our work in our government."

How Cobalt brings real-time exploit and threat intelligence to vulnerability findings. Sep 16, 2026 Est Read Time: 4 min Common Vulnerabilities and Exposures (CVE) identify known vulnerabilities in specific components. They don't confirm whether you're exposed or whether attackers are actively exploiting a vulnerability. The additional context from adding reliable threat intelligence and known CVE information to your pentest findings can make the difference between wasting time on research and triage and quickly identifying pressing risks that your business needs to address. Cobalt integrated CVE intelligence from VulnCheck directly into the Cobalt Offensive Security Platform. This new real-time exploit and threat intelligence shows up on suggested findings (for pentesters) and on validated findings delivered to customers. Now, on any finding tied to a CVE, Cobalt automatically surface: * EPSS score: Probability of exploitation in the wild within 30 days * KEV status: Whether it's on CISA's Known Exploited Vulnerabilities list * MITRE ATT&CK techniques: How attackers actually use this vulnerability * Publicly available exploits: Sources, PoC links, and dates Threat intelligence gives you the macro view of what tools adversaries are building across the internet. Offensive security research and pentest finding validation from Cobalt give you the ground truth: whether that flaw is reachable in your stack, how it connects to your broader attack tree, and what an adversary can actually do with it once they get in. Not every finding has a CVE Not all pentest findings are tied to known CVEs. CVEs catalog publicly disclosed security flaws in third-party software and hardware, whereas penetration tests frequently expose custom application errors, operational misconfigurations, and business logic flaws that will never receive a CVE. Common non-CVE pentest findings: * Business logic flaws: Defects in how proprietary application code processes workflows, such as altering item prices during a checkout process or bypassing step-up authentication. * Access control weaknesses: Insecure Direct Object References (IDOR/BOLA) and broken authorization models where authenticated users can view or modify another user's private data. * Security misconfigurations: Weak password policies, default credentials, exposed cloud storage buckets, permissive CORS policies, or improper TLS/SSL configurations. * Zero-day vulnerabilities: Newly discovered flaws in third-party software identified by the tester before the vendor or public database has assigned an official CVE identifier. * Human and physical security gaps: Vulnerabilities uncovered through social engineering (phishing, pretexting), tailgating into secure facilities, or cleartext credentials stored on internal documentation sites. What if the finding does have an associated CVE? A finding tied to a known CVE (sometimes) comes with a severity rating or CVSS score. The Common Vulnerability Scoring System is the open industry standard used to calculate a vulnerability's technical severity on a scale from 0.0 to 10.0. But severity rating alone isn't enough to decide what to fix first. Additional context is needed, including: * Is there a working exploit in the wild? * Has this been weaponized by ransomware operators? * Is it on CISA's radar for tracking? Obtaining this information without a partner is no easy task. The data is scattered across the National Vulnerability Database (NVD), the CISA Known Exploited Vulnerabilities (KEV) catalog, exploit repositories, and threat reports that you may or may not have access to. Researching all the necessary information is manual and time-consuming, pulling pentesters and security teams out of the work that matters most: finding more of the critical vulnerabilities in your systems. Cobalt added CVE context for faster discovery and remediation Cobalt pentesters already validate whether a CVE represents real exposure in your environment. They manually verify that the issue is reachable and exploitable in the target scope. For its expert testers, having instant access to exploit payloads and telemetry speeds up their manual verification, helping them test attack paths faster and back up their findings with real-world threat data. What gets surfaced If there's a known CVE in your environment, Cobalt enrich the finding in the Cobalt Platform with: * EPSS score: The probability a vulnerability will be exploited in the wild within 30 days. Model-driven and updated daily, so it reflects current risk, not a static rating. * KEV status: Inclusion on CISA's Known Exploited Vulnerabilities list confirms active exploitation in the wild, which helps teams prioritize the fix and meet compliance deadlines. * MITRE ATT&CK techniques: The adversary techniques mapped to the vulnerability. This connects the flaw to how attackers actually use it in an intrusion, not just that it exists. * Exploited by: The categories of threat activity tied to the CVE: threat actors, ransomware, botnets, VulnCheck canaries, and honeypots. It shows not just that a vulnerability has been exploited, but what kind of adversary activity has been observed. * Publicly available exploits: References tied to the CVE, from GitHub repositories to blog posts, each tagged by publication date and classified as proof-of-concept or weaponized, so you can tell a known technique from ready-to-deploy tooling. Why it matters for customers Remediation capacity is finite. Every security team faces more findings than it can fix at once, especially with the uptick in AI-assisted and AI-generated findings, and severity alone is insufficient for deciding what goes to the top of the queue. If you're relying solely on severity rating for prioritization, a critical-rated CVE that no one is exploiting will outrank a moderate CVE that ransomware operators are actively using. Additionally, real attackers do not look at vulnerabilities in isolation. They look at attack chains: pairing a known CVE in an external component with custom application weaknesses, like an authorization flaw or a cloud misconfiguration, to pivot deeper into an environment. Translating a finding into a remediation decision usually means making the case twice: to engineering to prioritize the work, and to leadership to justify the urgency. Severity alone rarely settles either conversation. Exploit and threat intelligence does. When a validated finding arrives with a high EPSS score, a KEV listing, weaponized exploits, or confirmed exploitation activity, the priority is not a matter of interpretation. It is a vulnerability to fix now, with the evidence already attached. That gives your security team the language to move findings from backlog to remediation, and to show the business why it mattered. Why Cobalt chose VulnCheck VulnCheck provides the relevant data to make prioritization of your Cobalt findings easier, so you can remediate the most consequential vulnerabilities that threaten your business. Most vulnerability data is purely vulnerability-centric. It describes the flaw only, not the impact or if and how it's being used in the real world. VulnCheck pairs vulnerability intelligence with exploit intelligence, aggregated from hundreds of sources, including its own exploit developers and honeypot canaries, adding the necessary context to streamline remediation. Available now The enrichment is live across suggested findings for pentesters and validated findings delivered to customers. There is nothing to enable or configure. When a CVE is identified on a finding, the available exploit intelligence is populated automatically. Prioritizing vulnerabilities has always been hard. With exploit and threat intelligence built into the finding in the Cobalt Platform, its pentesters verify attack vectors faster, and its customers get the context they need to act with confidence. If you have any questions, please reach out to your Cobalt team. If you're interested in learning more about its products and services, request a demo today. About Molly Finn. Molly Finn is the Senior Product Manager at Cobalt. With over 12 years of product leadership experience, she helps bring to life the Cobalt mission to take Pentest as a Service (PtaaS) further with an Offensive Security Testing Platform. Molly partners closely with engineering, design, and its customers to deliver end-to-end security testing across your attack surface. More By Molly Finn Related readings. Never miss a story. Stay updated about Cobalt news as it happens