VulnCheck

As a Security Researcher, I focus on vulnerability intelligence, exploitation analysis, and threat research. 

Vulnerability & Threat Research
- Conduct in-depth research on vulnerabilities, exploitation techniques, and emerging threats
- Contribute to the security research community through active collaboration and knowledge sharing

Data Analysis & Visualization
- Publish vulnerability data visualizations to highlight trends and insights
- Develop and share technical documentation and reports for internal and public audiences

Advocacy & Standards
- Promote open vulnerability standards such as CVE, CVSS, EPSS, SBOM, SSVC, and CISA KEV
- Advocate for best practices in vulnerability management and security intelligence
- Engage with Media, Press and Analysts

Product Collaboration & Strategy
- Collaborate with prospects and customers to align products with real-world needs
- Support product strategy by testing, validating, and providing feedback on intelligence tools

Security Research / Vulnerability Intelligence

Censys

Helped productize Censys from a free service hosted by the University of Michigan to a commercial service that is licensed by enterprise corporations. Helped build foundational go to market functions including SaaS selling motion, marketing strategy, product strategy and recruited top talent to the project.

Advisor / Seed Investor

Nucleus Security

- Created world renowned vulnerability data visualizations designed to promote vulnerability awareness and vulnerability management best practices.
- Published vulnerability research across open source vulnerability intelligence including CISA KEV, CNA, CVE, EPSS, CVSS, SSVC, MISP, CISA Top Exploited Vulnerabilities and other vulnerability related topics.
- Developed, published and promoted datasheets summarizing vulnerability related topics (CISA Top 10 Misconfigurations, Verizon DBIR CIS Controls, Australian Essential 8, etc.)
- Featured across Media publications including: Risky Biz, CSA SF - EPSS Talk, Intel471 Studio 471, Security Table Podcast, No BS CyberSecurity Podcast, Dark Reading, CSO, Resilient Cyber, Active Cyber, Bsides Las Vegas (Jen Easterly’s Talk), SC Media, Help Net Security, The Cyber Express.
- Produced Videos on vulnerability related topics including CVSS, EPSS, CISA KEV, SSVC, and more.
- Self-promoted all work on my Linkedin and achieved 5M+ impressions in 2023.
- Linkedin Promotion / Demand Generation / Content Marketing / Product Marketing / Events Management.
- Contributions to First.org EPSS Special Interest Group including the promotion of EPSS and tracking of EPSS Vendor adoption.
- Analyst Relations resulting in report placement with GigaOm (Leader), Forrester, Gartner, Omdia(Leader), G2, Frost & Sullivan.

Cybersecurity Researcher / VP of Marketing

Blumira

Joined as the first GTM leader. A ground up build taking an engineer team with a product to full GTM scale within 6-months of joining. Prior to me joining the organization had no dedicated GTM function. 

Key Accomplishments:
- Recruited and Hired the first 20+ Employees including leading Sales, Marketing and Product teams. 
- Established Blumira's high velocity SaaS selling motion.
- Lead product toward freemium trial leading to exponential customer and revenue growth
- Scaled top line revenue by over 3x 
- Established core marketing / messaging including Blumira's inbound lead generation
- Built the Blumira product roadmap through client discovery.
- Developed strategic partner integrations w/ Microsoft, Amazon, Cisco, OKTA and more.
- Implemented full stack Marketing / Sales operations tools and processes.
- Established Blumira's pricing / packaging and partner selling motions.
- Worked with investors to establish funding

VP of Operations

Duo Security

Responsible for product marketing including Duo and Cisco Zero Trust.

Key Accomplishments:
- Built, launched and own Cisco's Zero Trust GTM
- Lead Analyst engagement for Cisco for the 2019 Forrester Zero Trust Extended Wave
- Restructured Duo's Product Marketing organization for high velocity execution and output
- Hired key talent to expand Duo's Product Marketing capabilities
- Launched strategic campaigns for Cisco sales and partners

Director of Product Marketing - Zero Trust

Accomplishments:
- Restructured EMEA business for high growth in under 6 months
- Scaled ARR from $2M to $10M in under 12 months
- Lead EMEA business to consecutive quarters and years of over achievement
- Built EMEA's Sales and ADR Teams
- Supporting role in Duo's largest EMEA deal
- Onsite sales in Sweden, Czech, Republic, UK, Ireland and Netherlands.
- Was awarded the Duo Legend Award for contributions to Duo's EMEA business

Support strategic development of EMEA including:
- Coaching and Career Development within the EMEA sales organization
- Product Roadmap, Product Development Needs including EMEA product requirements
- Develop and Execute EMEA Marketing strategy including events, webinars and customer round tables
- Developing and Executing Duo's Go-to-Market strategy
- Supporting customer and prospect needs for effective security solutions
- Strategic Territory and Account Planning
- Sales Operations Optimization
- Higher Education Subject Matter Expert

Director of Operations, EMEA

Responsible for building and scaling Duo's sales engineering team to 15+ Sales Engineers.

Key Accomplishments:
- Lead 300+% YoY Sales Growth for 3 consecutive years
- Involved in hiring 100+ Employees @Duo
- Built, Scaled and managed Duo's WorldWide SE team
- Supported launching Duo's EMEA sales office in London
- Launched Duo's technical training program for SE's
- Optimized inbound lead process to increase lead conversion
- Lead Major Sales Initiatives including Sales Enablement, New Product Launches, POC Success Plans, SFDC Metric Management

Management Responsibilities Include:
- Recruiting, Hiring, Promoting, Career Development
- Pre-sales support for Duo Security's service offerings
- Pre-sales technical team leadership
- Large Deal Positioning / Negotiation
- Proof-of-Concept planning and delivery
- Competitive Evaluations and Battlecards
- Management and Delivery of all RFP, RFI and Security Questionnaires
- Feature Request Management
- Weekly Product Webinars
- Cross-Functional Collaboration w/ product, marketing, engineering and support

Director of Sales Engineering

Account Executive

Red Level Networks

Achievements:
- Closed 15+ net new Red Level clients in under 3 months generating $1M+ Annually
- Continued delivering new business to Red Level Networks after taking new opportunity w/ Duo

Business Development

Netarx / Logicalis

Many of the projects I sold included design and deployment of data centers, facility moves, network infrastructure, collaboration enhancements and network security. During my time at Netarx I was also involved with integrating the sales teams when we acquired Analyst International.

Achievements:
- Yearly Overachievement of Quota
- Promoted in first year from ADR to Account Executive
- Closed $2M+ Deal including recurring managed services

Account Executive / Sales Engineer

Cybersecurity/Vulnerability Researcher/Skateboarder

Patrick Garrity is a security researcher at VulnCheck where he focuses on vulnerabilities, vulnerability exploitation and threat actors.

He is a seasoned cybersecurity professional with over 15 years of experience in security research, marketing, sales, and product roles for high-growth SaaS cybersecurity startups.

At Nucleus Security, he led the marketing strategy, as well as conducted world renowned security research on various topics related to vulnerability disclosure, prioritization, exploitation, and scoring systems. He has successfully built relationships with analysts, press, and customers, resulting in increased visibility and recognition for the company in the market. He was instrumental in scaling Duo Security from $100k to $200M+ in revenue, launching Cisco's global Zero Trust strategy, spinning out Censys from the University of Michigan, and building Blumira's go-to-market team from scratch. He is also an active investor, advisor, and consultant for many early-stage cybersecurity startups. He holds a patent on app-based authentication. His expertise includes cybersecurity, vulnerability management, identity and access management, security analytics, zero trust, SaaS solutions, scaling startups, and leadership.

One of our core goals at VulnCheck has always been to help defenders gain better visibility into known exploited vulnerabilities. So far, we have achieved this through our free community service called VulnCheck KEV, which we collect and curate third party exploitation evidence.

In October, we began rolling out our new canary intelligence service which significantly expands visibility for defenders into real known exploited vulnerabilities. When a vulnerability is detected by a VulnCheck canary, it is automatically added to VulnCheck KEV.

Since the rollout of VulnCheck Canaries in mid October, we have observed exploitation activity that led to twenty-five new VulnCheck KEVs and expect to continue to be a top contributor of exploitation evidence to the broader cybersecurity ecosystem.

We will be discussing the new VulnCheck Canary Intelligence service in a few weeks so please join us: https://lnkd.in/gechPEWW

#cybersecurity #infosecurity #threatintel #riskmanagement

Patrick Garrity 👾🛹💙

Patrick Garrity is a seasoned cybersecurity professional with over 15 years of experience in marketing, sales, and product roles for high-growth SaaS cybersecurity startups. He is currently the Cybersecurity Researcher and VP of Marketing at Nucleus Security, a leading provider of unified vulnerability management solutions that help organizations manage and mitigate their cyber risks.

At Nucleus Security, he leads the marketing strategy and execution, as well as conducts security research on various topics related to vulnerability disclosure, prioritization, exploitation, and scoring. He has successfully built relationships with analysts, press, and customers, resulting in increased visibility and recognition for Nucleus Security in the market. Prior to joining Nucleus Security, he was instrumental in scaling Duo Security from $100k to $200M+ in revenue, launching Cisco's global Zero Trust strategy, spinning out Censys from the University of Michigan, and building Blumira's go-to-market team from scratch. He is also an active investor, advisor, and consultant for many early-stage cybersecurity startups. He holds a patent on app-based authentication. His expertise includes cybersecurity, vulnerability management, identity and access management, security analytics, zero trust, SaaS solutions, scaling startups, and leadership.

Lucas L.

Today we've launched, VulnCheck Canary Intelligence, a new service that captures real-world exploitation as it happens. The service is built from a global network of intentionally vulnerable systems that we call canaries. Our canaries record live attacker activity including payloads, IP addresses, geolocation data, and exploited CVEs.

Learn about how Canary Intelligence works:

Blog: https://lnkd.in/gw5AKMbA
Docs:https://lnkd.in/gV-zQmSz
Webinar: https://lnkd.in/gechPEWW

#cybersecurity #infosecurity #threatintel #vulnerabilitymanagement

Anthony Bettini

In a few weeks we are launching VulnCheck Canary Intelligence, which provides exploitation data from globally deployed real vulnerable hosts. The service reveals the first signs of vulnerability exploitation and tracks which CVEs are being targeted in the wild, by whom and provides the associated payloads.

The exploitation detections are already feeding into our community and commercial offerings, helping defenders gain visibility into real-world exploitation. The chart highlights the technologies that we are already detecting exploitation activity.

Join Jacob Baines, kimber D., and me as we discuss the new VulnCheck Canary Intelligence service in a few weeks:
https://lnkd.in/g--bvSdJ

#cybersecurity #infosecurity #riskmanagement #threatintel

Chief Technology Officer at VulnCheck

magical girl 🧙‍♀️ | Exploit Intelligence Product Manager 🫡

Hope everyone has a Happy Thanksgiving week!

#cybersecurity #infosecurity #riskmanagement #threatintel

One of the topics that often comes up is vulnerabilities known to be used in ransomware attacks. About a month ago, I was exploring ransomware attribution and created a chart that compares the ransomware attribution we collected and indexed in VulnCheck KEV with the ransomware attribution provided by the Cybersecurity and Infrastructure Security Agency (CISA) KEV, both of which are free resources.

From this research there are two main takeaways:
1. There is significantly more evidence of vulnerabilities being used in ransomware attacks beyond what is listed in the CISA KEV.

2. Many vulnerabilities attributed to ransomware activity are not included in the CISA KEV.

#cybersecurity #infosecurity #riskmanagement #threatintel

Cybersecurity and Infrastructure Security Agency

I’ve updated the board room with a 12-foot wide quarter pipe that I had refinished with recycled skatelite. #skateboard #office

I’ve been fortunate to help build several great cybersecurity companies over the past decade, and I’ve always wanted to share that journey. So when Thomas Richard invited me onto his podcast, it felt like the perfect chance to talk through some of the stories, experiences, and lessons I’ve picked up along the way.

If you have a moment, I’d love for you to give it a listen, and hopefully you’ll take away something new about how I see things just a little bit differently.

Podcast: https://lnkd.in/gaxBT8SQ

#cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

Last Friday we celebrated our 500th issued CVE at VulnCheck. This week we became a top 50 CVE Numbering Authority by volume. We have big news coming that will help expand our efforts in ensuring more software vulnerabilities receive timely CVE identifiers and enrichments through the CVE Program.

If you are a researcher looking to reduce the burden of coordinated disclosure and CVE issuance, please give our free service a try... https://lnkd.in/geduXSTE

#cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

CVE Program

It’s encouraging to see broader international government participation from European Union Agency for Cybersecurity (ENISA) in the CVE Program, especially at a time when future funding from Cybersecurity and Infrastructure Security Agency and MITRE remains uncertain and the organizations continue to highlight persistent resourcing challenges and poor decision making.

Hopefully this renewed involvement results in better outcomes than what we've seen from the EUVD vulnerability database launch.

#cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

It's always a joy to chat with Tod Beardsley. Thomas Bain and I sat down with him to discuss his time at Cybersecurity and Infrastructure Security Agency, emerging cyber threats he's currently engaged in researching, his perspective on the CVE Program and its future - and finally, horror movies, of which Tod is an aficionado and active podcast host himself.

Watch the full discussion here: https://lnkd.in/gyuT9WtV

#cybersecurity #infosecurity #threatcon1

It’s an interesting move for Chinese-founded TP-Link Systems Inc. to sue its U.S. rival NETGEAR at a time when U.S. lawmakers are pushing to ban TP-Link over national-security concerns. 🙃 

Tom Lawrence ✅ Chris Hughes 

#nationalsecurity #cybersecurity #infosecurity #tplink

A quick video snippet from this weeks livestream explaining how our new VulnCheck canary intelligence works and feeds into our various offerings including our free community offering VulnCheck KEV.

Access VulnCheck KEV for free here: https://lnkd.in/ghWfTvEk

#cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

A great look into Fortinet coding practices referencing OWASP® Foundation best practices by Tom Lawrence ✅

#cybersecurity #infosecurity #riskmanagement #securebydesign

Translating Complex Tech & Security Topics into Engaging Content — With a Side of Memes and 💩Posting for Awareness

Is Fortinet That Bad?

While this video is from a while ago it since it publication there have been even more poor coding practices found in their currently offered products. I have been keeping a catalog of them here for those that are curious https://lnkd.in/gJJuH5Av

And I am not here pointing out general flaws that come from mistakes made in coding, I am highlighting well known best practices that are being blatantly ignored. 

A crazy example that happened here in 2025 was the flaw found in their Web Application Firewall CVE-2025-25257.  A SQL injection found in a WAF if bad, but to then find that here in 2025 Fortinet was running MySQL AS ROOT is just wild. 
https://lnkd.in/gAcXq5qt

My Forum post with links to and descriptions of the issues
https://lnkd.in/gJJuH5Av

Full Video here
https://lnkd.in/gpxxxUTQ

What a super cool new free service from GreyNoise Intelligence that checks your IP for indicators that you’ve been compromised. 🙏

#cybersecurity #infosecurity #threatintel

V.P. Data Science @ GreyNoise Intelligence & MSIT Instructor for Data-Driven Security, Chief Data Officer & CISO Tracks; Chief Bannister Polisher

Is Your Home/Small-biz Network Compromised? Here's How to Find Out in Seconds

We just launched GreyNoise IP Check—a free tool that answers a question we hear constantly: "How do I know if my home network has been compromised?"

The scale of residential IP abuse has changed dramatically. Millions of home IPs participate in scanning activity every month due to:

• Residential proxy networks (often from sketchy browser extensions)

• Compromised routers and IoT devices

• Malware that quietly turns devices into botnet nodes

The worst part? It's invisible. Your internet works fine, Netflix streams, but your IP is building a reputation on blocklists.

What we built: Visit check.labs.greynoise.io from any connection and see instantly if your IP has been observed scanning the internet. The tool shows scanning behavior, activity timelines, and points you toward remediation steps.

Perfect for holiday tech support: If you're the family tech person, this gives you a 30-second network health check without being invasive. Concrete data beats vague "I think you have a virus" conversations.

For technical teams: Query via curl for JSON responses. No auth required, no rate limits. Build it into MDM systems, VPN scripts, or network onboarding flows.

Check your network. Check your parents' network. It takes seconds and could save you from a hidden mess.

Read the full launch post:

Open article: GreyNoise IP Check by check.labs.greynoise.io

Looks like we are on track for 800+ Known Exploitation Vulnerabilities (KEVs) in 2025 and the velocity doesn't appear to be changing much... 😮‍💨 

28.7% of KEVs we added to VulnCheck KEV are known to be exploited on or before the day a CVE is issued. This is one of the many reasons we should encourage vendors to disclose and patch vulnerabilities much faster.

If you want to take a look at our broader research you can check it out our research portal here: https://lnkd.in/gtMJ_Q49

#cybersecurity #infosecurity #riskmanagement

taplio

Patrick Garrity 👾🛹💙's Linkedin Analytics

Patrick Garrity 👾🛹💙

Performance ScorePatrick Garrity 👾🛹💙's LinkedIn Performance

What is Patrick talking about?

Patrick Garrity 👾🛹💙's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Patrick Garrity 👾🛹💙's Linkedin Analytics

Patrick Garrity 👾🛹💙

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Patrick Garrity 👾🛹💙's LinkedIn Performance

What is Patrick talking about?

Patrick Garrity 👾🛹💙's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Patrick Garrity 👾🛹💙's Linkedin Analytics

Performance ScorePatrick Garrity 👾🛹💙's LinkedIn Performance

Patrick Garrity 👾🛹💙's Best Posts (last 30 days)