Black Hat USA 2025 | John Morello, Minimus

Clips
More from Black Hat USA 2025

John Morello

CTO & Co-Founder

Minimus

play_circle_outline Introduction to theCUBE and the guests, Jackie McGuire and John Morello.

play_circle_outline Minimus's mission to simplify container security by building images with reduced vulnerability.

Info
Transcript

John Morello, Minimus

John Morello

CTO & Co-Founder Minimus

In this Black Hat USA 2025 interview, John Morello, CTO and co-founder of Minimus, joins theCUBE’s Jackie McGuire to discuss how his team is rethinking container security for a new era of cloud-native development. Morello traces his journey from co-founding Twistlock to launching Minimus, and explains how the company’s approach moves beyond simply identifying vulnerabilities to eliminating them at the source. By building purpose-driven, ultra-minimal container images from source, Minimus dramatically reduces attack surfaces — often cutting vulnerabilities by ... Read more

explore Keep Exploring

What is the focus of the discussion between Jackie McGuire and John Morello at Black Hat 2025, and what prompted the creation of Minimus? add

What challenges do customers face when managing risks and vulnerabilities in their container environments, and how is Minimus addressing these challenges? add

bolt Powered by CUBE AI

John Morello, Minimus

search

Jackie McGuire

>> Hello, CUBE community. Welcome back to Black Hat 2025 at Mandalay Bay in Las Vegas, Nevada. I'm Jackie McGuire, I'm the practice lead and principal analyst for security and your favorite security host for theCUBE, and I am joined today by John Morello. He is the CTO and co-founder of Minimus. John, thanks for being here today.

John Morello

>> Thanks for having me.

Jackie McGuire

>> We're going to talk about something that's a little bit personally painful for me, because I came into tech as a data scientist, so we're here to talk about containers.

John Morello

>> That's right.

Jackie McGuire

>> So tell us a little bit about what Minimus does and what was the onus for you to start Minimus and what problem you saw that you were trying to solve.

John Morello

>> Yeah. It's probably easier to talk about how we got to this point. We've actually been doing container security, myself, my co-founder, have been doing this for literally more than a decade now. Our previous company, Twistlock, that we started in 2015, we really started the whole container security space back in that era, did a lot of work, contributed to various open source things, things like the CIS benchmark for Docker, as well as we were the primary authors of the NIST Special Pub for container security 800-190. So it's an area that we've known really intimately for a while now. We ran Twistlock for four years, we sold it to Palo Alto Networks, that became Prisma Cloud now. But one of the things that, once we finished our time at Palo, that we kept coming back to was that throughout the entire time of Twistlock, we did a great job of being able to show people, here are the risks and vulnerabilities that exist in your containers, but then, ultimately, it was up to you as the customer to do something about them. And I think one thing that most people would probably identify with is that there's this never ending list of work and vulnerabilities and problems, and if it all comes back to you, it's very difficult to ever make progress with that. So what we're trying to do with Minimus is to completely short-circuit that, and instead of giving you just a list of the problems that might exist, the vulnerabilities that might exist, to actually build images in a very purposeful manner that results in you having images that, by default, just simply don't have those vulnerabilities. And we'll talk more, I'm sure, about exactly how we do that. But the fundamental value that we provide is giving you images that have exactly the same components, or at least the same primary component that you're trying to run from the normal official image, but none of the other extraneous stuff that adds to the vulnerabilities, and it really has a dramatic impact on the amount of risk that people have and the amount of work they have to do.

Jackie McGuire

>> Yeah, yeah, I personally have felt this. So I think it's crazy, first of all, to think that containers have been around for a decade. When I got into data science, they teach you how to write Python and the rule is always import everything. Until you decide what your project is, import everything, pip install everything. I was always like, well, if it's in pip, it's got to be safe, they wouldn't put anything in pip that wasn't safe. And so, I think that it was never really until I actually built my own cloud infrastructure and started deploying containers on the cloud, I never realized how wasteful that was, how large that made my attack surface, how much more vulnerable. And then, I started building containers and you realize that, oh, you maybe don't need all of those things. And as a data scientist, I was not really qualified to figure out which of those dependencies and packages and things I needed and which I didn't, so I could have used a Minimus and I could have used some help from my security team in not doing that. One of the other things, I think, is that having an inefficient container is not just a vulnerability, it's expensive. What's the ratio in terms of when you're looking at making secure containers for your customers, is there a percentage that generally they reduce them by by taking things out?

John Morello

>> It's actually interesting to see that it's pretty consistent, the reduction in vulnerabilities follows pretty linearly to the reduction in just the number of bits on disk. So if you take, for example, NGINX is one of the things I often show people because it's so ubiquitous, the official image from NGINX is like 80 megs on disk, the Minimus version of it is about seven megs, and we have concordantly about 98% fewer vulnerabilities right now as of today, like 100% today fewer vulnerabilities in that official image. But if you look across other things, like Python and Node and so forth, it follows pretty closely, and I guess not surprisingly, the more extraneous things that you can remove out of that image, the fewer vulnerabilities you're going to have in it. But the fact that it's so consistently predictable, I guess, is a little bit surprising with that.

Jackie McGuire

>> Is there a specific place that your customers generally start, is there low-hanging fruit that you generally find as these are the places that people are most often not doing well where they should be?

John Morello

>> Yeah. We have a lot of customers and they start in different places, so there's not really a right or wrong with it. I think there's two main ways that I've seen people approach it that seem to be successful. One is you can just simply say, I want to do the easiest things first. If you're utilizing, let's say, NGINX or Postgres or Redis or whatever it might be, from some kind of just upstream image and you just run that in your infrastructure, that's a really easy... You literally just say, instead of pulling it from Docker Hub, you pull it from reg.mini.dev and you get all these benefits, and there's really nothing else that you have to do. But if you look at people's infrastructure, from what we've seen, usually two-thirds or so of the vulnerabilities that they have come from these very easily, easily replaceable things that require no developer interaction really at all.

Jackie McGuire

>> And it's mostly just those out-of-the-box, I just started using this today.

John Morello

>> Yeah. Think about how much of your infrastructure is databases and caches and web servers and things that you're just using the defaults. You inherently don't want that to be something unique, you want to be just doing the bog standard thing, because you don't want to do anything interesting with your web server, you were trying to do something interesting with your app, right?

Jackie McGuire

>> Well, and I think the people that are spinning these things up are not always the best qualified to figure out what to use that's not out-of-the-box, right?

John Morello

>> Yeah.

Jackie McGuire

>> So when I'm spinning up a database to do some data science stuff, I'm not like, oh, what do I actually need?

John Morello

>> I always tell people, it's really one of those things where it's not really your fault as the customer in most cases, because if I'm trying to do the right thing and I'm pulling the very latest version of the official image for whatever project or technology I'm talking about, realistically, what should I as a user be doing better than that? That's the best guidance that you're going to give people that's going to be reasonably actionable. But if that thing that you're pulling down has, in many cases, many dozens, sometimes, like Python, hundreds of vulnerabilities out-of-the-box, in many cases, 40, 50 or more higher critical vulnerabilities, you're starting off from such a bad place that there's really... You're never going to get ahead, you're never even going to catch up to where you ideally want to be with it. And that's, I think, the real value of this solution is... I've worked on a lot of security things over 25 years of doing this, and there've been a lot of tools, like I said with Twistlock, that could tell people, "Here are things that you need to be concerned about, risks that you need to mitigate, actions you need to take." This is the first one where it's really like, if you just use this tool or these capabilities, you're going to have much less work, in addition to much less risk, and that's a really different approach to security and one that people that are not just security professionals, but people that are just developers, get a lot of value out of, because it saves them from a lot of tedious, uninteresting, undifferentiated effort.

Jackie McGuire

>> Yeah. Burnout is one of the things that we talk about a lot that is always an undercurrent in security and IT and is a huge risk, because unfortunately, your hardest-working, most exponent employees are generally the ones that burn out the fastest, because they're the ones who they can't sleep at night when there's a bunch of untriaged alerts, it keeps them up when there's something that's not done. And so, to be able to have somebody who has your back who's like, hey, this is stuff that really is pretty basic that can be dealt with, and I think that's... There's so many things in security that are subjective or that require you to make determinations about things, but to your point, some of these things, it's just basic hygiene, but if you don't have someone dedicated to doing that basic... And I think that's where a lot of companies, they don't realize, yes, you do need people triaging alerts, but when you buy a tool, when you decide to deploy a new architecture, a lot of times, you need people just managing those things. And when we talk about most AI projects are being spun up in the cloud now, some large enterprises are doing it on-prem, but a lot of them are being deployed in the cloud and we're just spinning things up, and data scientists, again, we're not the best people to decide what containers we need, and I think having someone to take that stress off of us and create a more productive relationship between everybody else in the enterprise and security is a good thing.

John Morello

>> Yeah, absolutely. And one of the things I think that's also interesting about our approach, I know the audience here is usually pretty technical, but it's a key thing that we do that really not only helps you reduce the vulnerabilities you have at the beginning, but actually allows you to consume fixes for them more rapidly, is all of these images and all the components that we have within them, we're building all of that software directly from source. So the thing that's important is you could take... There's operating systems like Alpine, for example, that really advanced the state-of-the-art during Twistlock days, where it provided a much more minimalistic attack surface because there was less stuff at the OS layer, and it was a good step, and it is a good step, but it still has more than really is necessary for running most containers, and it also has a full release process in and of itself. What we're doing though is we're monitoring today more than 20,000 discrete open source projects, not just the things you know about, Redis and whatnot, but all the little subcomponents and dependencies of those and third order dependencies of those, we monitor that at the source level. And so, we're looking at that continuously, when there's new versions of that, we see it, we pull it, we compile it and we create the images, and all you have to care about, as a customer, as a user, is there's this standard OCI-compliant image and I just simply use it. And I know, as long as I'm using this image, that it's always up to date and I've got the most realistically minimized, to your point about attack surface, but also just efficiency, the most minimized image that I can to run that application, and that's a real benefit. That approach though also means that when there's a new fix upstream, that we're not waiting on that fix to get packaged up for a given operating system and then to make its way through its quality gates, like edge and testing and stable, and then you get the image and you have to rebuild it. We're just able to simply do that instantly, effectively within hours, because we're building everything from source. And so, not only do you get things that have far fewer vulnerabilities to start with, but you get something where it's going to be maintained in a much more perpetual, automatic manner to have that low vulnerability state over time.

Jackie McGuire

>> Yeah. So it's important to note that this isn't just removing things from an existing, it's actually custom containers.

John Morello

>> Yeah, it's building all of these things from source, and building them in our approach is completely you get images that are built without any underlying operating system in a classical sense. And so, there's just nothing else, it's just the app and just what's required to run it, so it's as minimalistic of an attack surface as you can have.

Jackie McGuire

>> Awesome. So tell me about what you have going on at Black Hat. I assume you're here, we can send people over your way to come see you?

John Morello

>> Yeah, absolutely. We'd be happy to show and to tell whatever to anybody. We're in booth 4608, so we can give you a demo. We have some interesting, funny T-shirts that people probably will like. We're of course on all the normal social media platforms, you can follow us on LinkedIn and Instagram and all those kinds of things. And of course, you can just go to the good old website, minimus.io.

Jackie McGuire

>> Awesome. It was wonderful to have you, John, thanks for joining us. I'm sure we'll have you back. This was great information, and I know a lot of my fellow data scientists appreciate it, because it's something that is on the periphery for us, but not necessarily our core competency, so really appreciate it.

John Morello

>> Yeah, great. Thanks for having me, I appreciate that as well.

Jackie McGuire

>> Thanks. Stay tuned for more CUBE. We are in Las Vegas, Nevada at the Mandalay Bay for Black Hat 2025. This is Jackie McGuire. I will be back shortly with more great interviews and guests.