Security Weekly - A CRA Resource: Safely exploiting vulnerabilities at scale, TVs attack privacy, and the news - ESW #476

Interview with Snehal Antani

Snehal Antani, CEO and co-founder of Horizon3 joins us to talk about how automated validation can help with exposure management. As vulnerability counts spike, security teams are looking for a way to prioritize. Automated penetration testing offers a way to quickly separate exploitable vulnerabilities from the rest.

This segment is sponsored by Horizon3. Visit https://securityweekly.com/horizon3 to learn more about them!

Topic Segment - SmartTVs and Privacy

For this week's topic segment, we explore privacy and TVs. LG has been in the news for allegedly collecting data from its customers, but the facts are unclear: https://www.theregister.com/security/2026/09/08/lg-accused-of-egregious-invasion-of-privacy-over-tv-data-collection/5294956

We share our recent experiences and dive into some of the primary concerns and theories about what's going on here.

If you want to opt out of some of your TV's data collection, Consumer Reports has a collection of instructions for a variety of TV platforms: https://www.consumerreports.org/electronics/privacy/how-to-turn-off-smart-tv-snooping-features-a4840102036

Weekly Enterprise News

Finally, in the enterprise security news,

1. We check the vibes
2. We check finding and acquisitions
3. Nightmare Eclipse or Good Night of Sleep Eclipse?
4. Update on Anthropic’s Glasswing project
5. How long would it take for a mobile phone worm to spread?
6. Don’t expose SSH to the public Internet
7. Massive amounts of cryptocurrency continue to get stolen
8. Did you actually read your third party’s SOC 2?
9. Your boss may be reading your AI chat history

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-476

00:00:00 Episode Overview, Hoagies, and Show Announcements
00:04:43 Automated Pen Testing for Prioritization and Remediation
00:10:44 Ensuring Production Safety with AI Hacking Tools
00:17:49 The Reality of Ineffective Security Controls and Exploitable Chains
00:22:42 Prioritizing, Deceiving, and Training with AI in Security
00:28:35 Navigating the Untested Legal Waters of AI-Driven Hacking
00:32:15 Are Smart TVs Unavoidably Collecting Your Personal Data?
00:38:10 Understanding Device Listening and Opting Out of Data Collection
00:46:32 The Implications of Always-On Recording on New Devices
00:50:31 Who Owns Mid-Market Security and Acquisition Trends
00:57:30 Re-evaluating Zero-Day Timelines and Insecure Software Warnings
01:06:29 WeChat Worm: Exponential Spread and AI's Role in Discovery
01:15:57 Frank Wayne's Essay: Rethinking Security with AI Dynamics
01:21:31 Anthropic's Glasswing Project: Finding Vulnerabilities vs. Real Impact
01:32:46 Exposing Legacy Vulnerabilities and Hidden AI Hardware Gadgets
01:39:57 Thank You and Preview of Next Week's Episode