Adam Dudley

Chief of Staff & VP @nucleussec, employee #2. Nearly 7 yrs in vulnerability management. Got here by showing up, not applying. Built mcp-audit. Poker player.

[Adam Dudley @AdamDudleyX]

1/ I had my agents run mcp-audit against the 100 most-downloaded MCP servers on npm (6.7M downloads/week), from a clean sandbox with no API keys. 60 connected and handed over their tools. Here's what 1,611 tool definitions look like.

[Adam Dudley @AdamDudleyX]

@vineerpasam Juniors still have one edge: they'll take the side door. After my bootcamp I got hired as a developer slash marketing manager by showing up in person and meeting people, not by applying. Go where the people who hire are.

[Adam Dudley @AdamDudleyX]

@stretchcloud The agent wrote a new server into its own global MCP config, a file most teams never look at. Treat it like a dependency list: record which servers you approved and flag any that show up later.

[Adam Dudley @AdamDudleyX]

@jgreigj @TheRecord_Media Right direction. Nucleus reviewed every KEV addition from Oct 2025 to Mar 2026: of 22 CVEs with meaningful early signals, 14 had no confirmed exploitation yet, and all 14 later made it onto KEV. Waiting for confirmed exploitation is waiting too long.

[Adam Dudley @AdamDudleyX]

@CISAgov Glad to see Harden built around the infrastructure whose disruption would hurt most. That only works if each of those systems has a named owner and its vulnerabilities get fixed first. Impact beats severity score every time.

[Adam Dudley @AdamDudleyX]

@logangraham If you red team yourself all the time, the findings never stop, so the program behind it matters most: every finding goes to a named owner with a deadline. And if they'll hit your dependencies, you need an owner for each third party too.

[Adam Dudley @AdamDudleyX]

@ResilientCyber +1 on defender evals. I'd score them on what happens after the find: did the fix go to the person who owns that system, did it ship, and is there proof it's closed. Finding is the easy half now.

[Adam Dudley @AdamDudleyX]

@George_Kurtz @Downtown Aviation is a good model for that shift. Safety there runs on checklists, named owners and reporting near misses instead of hiding them. I moderated a panel at the Aviation ISAC summit this year, and security programs could use all three.

[Adam Dudley @AdamDudleyX]

@George_Kurtz @Downtown Security moving into safety is a good way to put it. If I were a CISO, I'd settle one decision before the next incident: who can shut off an AI agent's access, and how fast.

[Adam Dudley @AdamDudleyX]

David Rubinstein at @sdtimes rounded up expert takes on PHP2Shell yesterday. Our cofounder Scott Kuffer's is the one to act on: the teams that get through this "already knew where PHP was running in their environment," who owns it, and who patches it.

https://t.co/LzszJREkDH

[Adam Dudley @AdamDudleyX]

BOD 26-04 ties remediation deadlines to exposure, exploitability and impact, so agencies need an answer for every finding, not just a scan report. Former CISA CIO Bob Costello brings the questions he'd ask, and our cofounder Scott Kuffer answers them live. New date: Nov 3!

[Nucleus Security @nucleussec]

New date: November 3 at 2 PM ET / 11 AM PT.

See what BOD 26-04 looks like in practice, using PHP2Shell as a real-world example.

Bob Costello will bring questions he’d ask as an agency CIO, while Scott Kuffer works through them live in Nucleus.

Register: https://t.co/mx26CClboE

[Adam Dudley @AdamDudleyX]

@natashenka @5aelo Great to see this measured instead of argued. Whichever one finds the bug, someone still has to own the fix and ship it, so I'd love a follow-up on time from report to patch for each.

[Adam Dudley @AdamDudleyX]

@jeremiecharris Good point, and it cuts both ways. If attackers stop banking vulns, the gap between disclosure and exploitation shrinks again, so waiting for KEV to confirm it means you've waited too long. The owner and the deadline should be set the day it's found.

[Adam Dudley @AdamDudleyX]

@k8em0 Kaminsky's DNS bug is a great reference point. If more of these are coming, every vendor needs to know before the call who on their side can approve an out-of-band patch. Someone at the Aviation ISAC summit called it mean time to authority.

[Adam Dudley @AdamDudleyX]

@anton_chuvakin @unpromptedconf Agreed. If I were picking the first invariant, it would be that nothing internet-facing runs without a named owner. Attackers will always be faster, but the box nobody owns is the one that never gets fixed.

[Adam Dudley @AdamDudleyX]

“Every day is zero-day” isn’t a forecast anymore. It’s last week’s timeline.

PHP2Shell: exploitation attempts Oct 17, patches Oct 21, CISA KEV Oct 26. The attackers had a four-day head start.

This week, customers didn't ask for the patch. It was proof: what’s actually running, when it was last scanned, and a trend leadership can read.

Patching closes the hole. Proof ends the incident.

[Adam Dudley @AdamDudleyX]

@cognition Big commitment, and good to see prioritizing by exploitability in your own environment as its own step. After the fix PR, it still takes a human who owns that service to approve the merge, and a rescan in production to confirm it's closed.

[Adam Dudley @AdamDudleyX]

@jeremiahg If I were grading the industry, I'd want every forecast published before exploitation and scored after, like a weather forecast. Counting the misses in public is what ends the guessing!

[Adam Dudley @AdamDudleyX]

@ResilientCyber Agreed. If I were a CISO this week, I'd list every SaaS integration holding a token into HR, sales and IT, and give each one a named owner who can revoke it the same day. Agents chain those connections fast, so who pulls the plug has to be settled first.

[Adam Dudley @AdamDudleyX]

Saw the same lag one layer down. In the scan of the 100 most-downloaded MCP servers on npm I posted yesterday, 16 of the 66 built on the TypeScript SDK still didn't resolve to the version fixed after the Oct 20 disclosure. About 412K downloads a week. The lockfile tells you. The changelog won't.

[Adam Dudley @AdamDudleyX]

@guruchahal That 3.2x vs 1.6x gap lands on the same people. Asset owners didn't triple in two years, so the review pile grows faster than anyone can work it. I'd love to see that chart cut by owner: who's sitting on the most open CVEs, and for how long.