Welcome Early Warning System! Straight jackets are on the left, Meds to the right, Here I am stuck here in the middle w/ you. Army Vet. Read tweets @ own risk!
Joined June 2013
- Tweets112K
- Following4.4K
- Followers6.3K
- Likes33K
Advice to legal:
Not every sentence needs improvement simply because Track Changes is turned on.
—there isn’t any credit given by how many edits made to the terms !!
Vendor contract dealing:
Me: “What control were you trying to solve with this edit?”
Vendor legal: “There wasn’t one.”
Me: “Great. Delete it.”
Vendor legal: “Well, let’s not make any rash decisions.”
—and they just did, repeatedly
Vendor contract legal … there comes a time when it appears legal is paid by the letters edited in a contract !!
Not the words but by the letters. Dear gawd, it gets annoying.
Vendor argues:
Vendor: “AWS performs the physical security controls.”
Me: “Fine”
Vendor: “AWS is independently audited.”
Me: “Also fine.”
Vendor: “Therefore we’re no longer accountable for physical security.”
Me: “Now we are not fine.”
*sighs*
As you can see by my recent postings about vendor contract terms, either I get a headache or I can laugh … I prefer laughing. And some of them are sooo good.
Vendor: “Our SOC2 demonstrates compliance.”
Me: “Excellent. Which control actually ?”
Vendor: “ … “
Me: “Take your time. I have the report open.”
Would you accept this edit in Access Management / controls? “Utilize single use credentials, >>where applicable<<“ was added ??
—hint, it is a loaded question !
Vendor: “Our cloud provider handles that.”
Me: “Wonderful. Make sure that your contract with them requires it.”
Vendor: “But they’re responsible for it.”
Me: “I heard you the first time. And you’re responsible to us.”
—fyi, I don’t have an agreement with your cloud provider, you do !!
Real quick … for those of you that know what a SOC2 is, please advise your legal counsel that is NOT a security standard.
A SOC2 doesn’t not prescribe security standards, it’s a measurement of how compliant you with your own standards, and hopefully you made those based upon recognized standards, such as NIST, or ISO.
*sighs*
Vendor contract pushback …
Vendor: “We do not provide client-specific security documentation.”
Me: “Fine. I’ll take the client-facing security documentation you already provide in the link you sent earlier.”
Vendor: “ … “
Me: “Glad we cleared that up.”
Sniper Barbie retweeted
Microsoft Says AI Agents Cannot Be Trusted and Could Become Insider Security Threats
Details: cybersecuritynews.com/ai-mod…
Microsoft warns organizations to treat AI agents as potential insider risks not because they are automatically malicious, but because they can access company data, apps, and tools and act on that access at high speed.
The warning, published on October 19, 2026, comes as businesses use agents to handle tasks such as writing code, reviewing documents, and processing expenses.
An agent’s actions can change as its instructions, data, or working context change. It may make a mistake, follow harmful directions hidden in a document, or be compromised.
#cybersecuritynews
Security: “Yes, that’s absolutely our process.”
Legal: “We cannot contractually commit to that.”
Judy: “Have you two met yet in your enterprise?”
Summary of vendor-negotiation industry in two sentences:
Security: “We’re fully capable of meeting that requirement.”
Legal: “We cannot commit to meeting that requirement.”
-The End.
Security: “This is mandatory throughout our organization.”
Legal: “We prefer ‘where applicable’.
—security is no longer controlling the meeting
Security: “Everyone has to follow the policy.”
Legal: “Limit it to relevant personnel.”
—now we have to define who is Everyone
Security: “We remediate according to severity.”
Judy: “Great. Critical 15, High 30, Medium 90?”
Legal: “We use a risk-based methodology.”
—the actual numbers frighten Legal
Security: “We have annual independent penetration testing.”
Legal: “We’ll agree to periodic testing.”
Judy: Security offers better terms than Legal did.