Security Is No Longer a Visibility Problem, It's an Evidence Problem

Security Is No Longer a Visibility Problem, It's an Evidence Problem

by Shira Rubinoff · View the channel on PSI

Humanities, Social Sciences & Thought Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Shira Rubinoff 👥 1.0M 📅 September 30, 2026 ⏱ 10 min 👁 126K 📄 expert opinion 🧭 2026-10-06
Available in: English (current) Français

Keywords

continuous security validationattacker perspectivevulnerability prioritizationAI-powered attackstraining like you fight

Summary

In this interview, Shira Rubinoff discusses with Snehal Antani, CEO of Horizon3.ai, the evolving nature of cybersecurity threats and the inadequacy of traditional approaches. Antani argues that AI has given attackers ‘unlimited cyber bullets,’ enabling them to target any organization regardless of size, expanding the attack surface beyond the enterprise to include suppliers and partners. He critiques the assumption that large budgets equate to robust security, emphasizing that compliance and point-in-time security assessments fail to guarantee resilience. The conversation shifts to the concept of ’evidence over visibility,’ where organizations must continuously validate that vulnerabilities are actually exploitable in their specific environments, rather than just collecting visibility data. Antani outlines a prioritization framework based on three factors: exploitability, known use by adversaries (e.g., Salt Typhoon), and potential business impact. He advocates for continuous security validation over annual penetration tests, using the analogy of brushing all teeth frequently rather than one once a year. Finally, he stresses the importance of ’training like you fight’ to build muscle memory for incident response, including decision-making authority and handling crises under realistic conditions. The interview provides practical, experience-based insights for CISOs and security leaders.

189 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video offers valuable, actionable insights for cybersecurity professionals, particularly the reframing of security as an evidence problem rather than a visibility one. Antani’s reasoning is sound and grounded in real-world experience: he effectively explains how AI increases attacker speed and breadth, making it impossible to rely on intermittent checks. The prioritization framework (exploitability, attacker usage, consequence) is practical and directly applicable, helping organizations allocate scarce resources. His analogies, such as Brushing all teeth all the time and training like you fight, make the arguments accessible and memorable. However, the argumentation relies heavily on anecdotal evidence and personal authority rather than statistical data or case studies, which weakens the overall scientific rigor. The lack of concrete examples or metrics regarding the effectiveness of continuous validation could be seen as a limitation. Nonetheless, the logical flow is consistent and persuasive, offering a clear shift in mindset for security teams.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite any formal sources, research papers, or external references. The arguments are based solely on the guest’s professional experience and observations, which limits the verifiability of the claims. The description includes no links or references, and the transcript mentions no publications or studies. The title is highly appropriate as it captures the core message of the video. The content aligns well with the title, with the guest explicitly stating that security is now an evidence problem. However, the absence of sources means the quality of the information depends entirely on the credibility of the speaker, which is decent given his background as a former CIO and CEO of a cybersecurity firm. The lack of formal citations is a significant weakness for a scientific evaluation, but the practical nature of the discussion may compensate for the target audience of practitioners. The title does not overpromise, and the video delivers on its promise, so the adéquation is excellent.

323 words

Title / Content Match

The title accurately reflects the central thesis of the video: that security should shift from mere visibility to evidence-based validation, a point consistently discussed by the guest.

Quality & Reliability

7/10

The content is based on the professional experience of a former CIO and current cybersecurity CEO, but it lacks cited sources or empirical data, reducing its verifiable reliability.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Contribution & Novelties

The video’s primary contribution is reframing cybersecurity as an evidence problem, arguing that visibility without proof is insufficient. It introduces the concept of ‘unlimited cyber bullets’ to illustrate how AI lowers attack costs and expands targets. The prioritization framework based on exploitability, attacker usage, and business consequence offers a practical decision-making tool for resource-limited CISOs. The emphasis on continuous validation over periodic assessments aligns with emerging industry trends. However, the ideas are largely anecdotal and lack empirical backing, which limits their novelty in a strictly scientific sense. For deeper exploration:

Pour aller plus loin :

  • Salt Typhoon APT group — Relevant as an example of a sophisticated threat actor used to illustrate prioritization urgency.
  • Breach and Attack Simulation (BAS) — Directly relates to the concept of continuous validation and automated security testing.
  • NIST Risk Management Framework — Provides a structured approach to managing security risks, complementing the prioritization advice.
  • MITRE ATT&CK Framework — Useful for understanding attacker tactics and techniques, including those referenced in the interview.
  • NIST Cybersecurity Framework — A broader reference for organizational security practices and continuous improvement.

180 words

Radar Profile

The profile shows moderate scores across all dimensions, with slightly higher ratings in information quality and quantity relative to technical depth. This reflects a discussion that is insightful and relevant but leans heavily on personal experience rather than rigorous technical detail or empirical evidence.

Reliability 6/10