Which attack vector is more successfully exploited, social engineering or the one targeting vulnerabilities?
Yoran: That’s great question. I think that the attack surface is so large. Whether you’re going into a supplier, whether you are socially engineering an employee, or whether you’re doing some sort of spear phishing type of exercise. The attack surface is so large and the IT security industry’s ability to adequately protect a complex enterprise is so poor that I believe we have to have a shift or a change of paradigm in how we think about security. We have to believe, and I would say almost every security industry leader that I respect today, we have to believe that our defenses are imperfect and that our adversaries, criminal or otherwise, are already on the inside and that no matter what we do to protect ourselves they’re still going to get inside. Yoran: How do you live, how do you operate in an organization’s IT environment, and how do you enable the organization to still accomplish their mission knowing that their IT systems are already living in a state of compromise? The bad guys
