Episode 25: AI, Vulnerability Management & The Future of GRC Engineering

In this episode of the Distilled Security Podcast, we dive into AI-driven vulnerability management, a massive breach hitting 9,000 educational institutions, and the future of GRC engineering, including a live preview of what autonomous compliance agents actually look like in practice.

🔹 AI & Vulnerability Management — Why the next 6–18 months will be a patching crisis, how AI models are accelerating zero-day discovery, the operational reality of back-to-back criticals, surge scenario planning, burnout risk, and Microsoft's M-Dash orchestrated agent approach

🔹 The Canvas/Instructure Breach — 275 million records exposed, finals week disrupted across 9,000 universities, a rumored $10M ransom negotiated by the SaaS provider, the ShinyHunters connection, and what this means for critical infrastructure concentration risk

🔹 GRC Engineering Meets AI — Deterministic vs. non-deterministic testing explained, why auditors can't rely on AI-generated evidence, autonomous agents with segregation of duties, the episki 2.0 platform preview, and the emerging role of the "orchestration conductor" in security teams

🥃 Spirit Review: Heaven Hill Grain to Glass (DSP KY-1)

⏱️ Timestamps

00:00 – Intro & Topics Overview

01:27 – AI & The Coming Vulnerability Surge

07:00 – Patching Windows, Burnout & Operational Reality

16:40 – Surge Scenarios, Fix-It Weeks & Recommendations

21:20 – Microsoft M-Dash: Orchestrated Agent Scanning

25:56 – The Canvas/Instructure Breach Breakdown