From Runtime to Pre-Change Review | Garrett Hamilton x Jonathan Brucato

Much of security work happens at runtime, finding issues after a change has already shipped. Garrett explains how Reach is opening its agents through the MCP server so teams can ask “what if” before a rule or change goes out. The goal is to give the engineers and change control boards reviewing those changes more confidence before they sign off.

In the full episode:

⇢ Why Reach starts from the controls a team already owns instead of working backward from the attack
⇢ How protection can disappear with no one touching it, like a new rule shadowing an old one or a server moving out of a group
⇢ What security could borrow from DevOps, including testing a change before it ships and rolling it back when it fails
⇢ Three ways to prioritize fixes: compliance goals, threat-informed exposure, and drift from your own baseline
⇢ Why security vendors should supply the data and let teams build their own executive reporting
⇢ What’s next for Reach, from compensating-control context in exposure management to asking “what if” before a change goes out

Full episode: https://f.mtr.cool/133ng20vrf