Building enterprise security programs that actually work | 20+ yrs cybersecurity | CISSP, CRISC | LinkedIn Learning (238K viewers) | Cyber Program Blueprint
Joined December 2010
- Tweets7.5K
- Following962
- Followers4.9K
- Likes79.9K
The board doesn't want more security metrics. It wants to know what could hurt the business, who owns it, and what's changing.
AI can draft the security analysis. It can't own it. If your name's on the report, you signed off on every word, and "the model said so" won't fly with anyone who matters.
187 unauthorized transfers over three days, and the bank couldn't find them in its own records. An ISO 27001 certificate tells you the controls existed on audit day. It doesn't tell you anyone's watching the payment logs now.
The fastest way to lose executive trust is to surprise them. Tell them about a serious risk before it turns into an incident.
Good advice. Just don't walk in asking for "more security." Bring a short list of the basics you're missing, what each gap could cost the business, and what it takes to close it. Specific asks get funded.
A new CISO's first 90 days aren't for buying tools. They're for learning who owns what, and what nobody owns.
Patching is the easy part. The real danger is the tech debt nobody's found yet, running versions too old to fix.
None of the companies caught the attacks. The AI providers had to tell them. CERT-In says the agents got in through exposed credentials and overly broad cloud roles. That isn't a new AI problem. It's old hygiene debt, and agents just find it faster. “Weaknesses exploited at machine speed.”
CERT-In has published Advisory on its website:
AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets
cert-in.org.in/s2cMainServle…
Microsoft released more CVEs this month than in all of last year. Patch what's exploited and internet-facing first, set deadlines by risk, and tell leadership about anything important that waits.
October Patch Tuesday is a big one: 1,400+ CVEs addressed.
That’s more CVEs in a single release than we shipped in all of 2025.
A huge thank you to the security researchers and Microsoft teams whose work made this possible.
msrc.microsoft.com/update-gu…
@msftsecresponse
"Nobody's exploited it yet" isn't a risk decision. It's a bet. A credible warning should get an owner, a written decision, and a date to revisit it. Waiting for the first loss means the attacker picks your timeline.
Ledger was warned last March about implants by hardware hacker @joegrand but apparently did little because no one had yet used implants to steal crypto. That changed last wk with the heist of hundreds of accounts. There is evidence stolen seeds were sent to servers in Hong Kong
The French supermarket attack is exactly this. Most of the controllers hit were out of support, and they're often managed remotely by refrigeration contractors, not IT. That's an ownership gap more than a tool gap. "Nobody would bother attacking us" stopped being a strategy once attacks got cheap.
Get ready - the world created a sprawling web of internet connected devices in the name of efficiency and has repeatedly under invested in cybersecurity.
Industries closest to monetizable assets (traditional finance, crypto, critical intellectual property, high tech) have faced dedicated adversaries and been forced to keep pace with cybersecurity defenses.
However, other industries have been able to skate under the radar as the effort to exploit hasn’t been worth the investment of an attacker.
The world is changing and the cost to launch attacks are plummeting.
Expect important industries for the world to function, that may have underinvested in cybersecurity, to be frequently exploited.
reuters.com/business/retail-…
💯 Continuous improvement should be the goal, not perfection.
Treating models as insider risks is the right call. Many companies struggle to get insider risk right for people, though. Start with the basics: containment, least privilege, monitored logs, and a named person who can shut it off.
Good tabletop scenario: AI labs are gaming out the day after a major AI-based cyberattack on banking or power. Assume a critical provider is down for two days and test how your business responds.
Scoop: Top executives at Anthropic, OpenAI and other AI companies are privately gaming out scenarios for a public and political revolt after a catastrophic AI event…They assume one in ‘27…
axios.com/2026/10/09/ai-comp…
Yep. Keep compliance and architecture on the long map. Everything else should move as fast as the threats and the business do.
The 36-month roadmap faded because the ground keeps shifting. Keep the long view for principles and compliance. Reset tools and priorities frequently. AI just made that obvious.
If an AI agent has privileged access and nobody owns that access, you don't have an AI problem. You have an access-governance gap.
AI Agents Are Privileged Users; Who Is Auditing Their Access? bit.ly/3Te1FH4 Commentary by Ravi Sharma, Senior IT Audit & Cybersecurity Leader, Pitney Bowes
