Securance is an IT audit and cybersecurity firm with more than 20 years of experience helping clients improve security, compliance, and risk management.
Tampa, FL
Joined February 2018
- Tweets2.3K
- Following1.3K
- Followers1.1K
- Likes352
Your incident response plan is a hypothesis until you test it.
Securance founder and president Paul Ashe on why most IR plans have never faced a realistic ransomware scenario, and what we’ve learned running tabletop exercises across industries: youtu.be/iwcCKvpwfw4?si=-O46…
Who has authority to set a ransom ceiling? Many IR plans assume someone does. In a tabletop with a regional food and beverage manufacturer, that was one of three questions the plan had left to assumption. Each now has a written answer and a named owner.
securanceconsulting.com/case…
NIST’s initial design tenets for agent identity are worth reading in full. The one closest to an auditor’s heart is #10, Immutable Evidence. If an agent can touch its own logs, you don’t have an audit trail. You have a suggestion.
🎉NEW @NIST BLOG!
Design Tenets for Agent Identity Management Systems
We’ve defined an initial set of “Design Tenets” for agentic identity, authentication & authorization
nist.gov/blogs/cybersecurity…
A scanner tells you what might be vulnerable. A penetration test shows you what's actually exploitable, and the exact path an attacker would take to get in.
Here's how we test networks from the outside in: youtu.be/lBwOQTNfxQ8?si=BZZW…
#PenetrationTesting #CSaaS
Securance retweeted
We added #PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to our Known Exploited Vulnerabilities Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org. #Cybersecurity #InfoSec #RCE
ALT Image showing the CISA logo and text: "Known Exploited Vulnerabilities Catalog" with "Updated" labeled prominently. Website: cisa.gov.
Michigan's state agencies had about 370 disaster recovery plans. 229 had no recorded test date.
Ransomware crews go after the backups first. Untested plans fail the night they're needed.
Free white paper, no form:
securanceconsulting.com/whit…
#Ransomware #DisasterRecovery
Who can still log in to your critical applications after someone leaves or changes roles?
Our application provisioning review checks how access is granted, changed, and removed, before the gaps become audit findings. #AccessManagement
Watch: youtu.be/xkzfz_P-Z4k?si=61Oh…
Worth a look if you run PHP anywhere, including apps a vendor hosts for you. First step SANS recommends: get PHP management interfaces off the internet.
Patches for the 2 critical PHP vulnerabilities are out. If you can’t deploy them yet, @mosesrenegade, Senior Instructor at SANS Institute walks through temporary measures, starting with getting PHP management interfaces off the internet. Recording of the emergency livestream here: go.sans.org/MpvmG6
#PHP #Vulnerabilites
One compromised login. One ETS file transfer site. About four months of copying California student records before anyone noticed.
Transfer monitoring often confirms files arrived, not who took them.
Questions to ask about your own exchange points: securanceconsulting.com/post…
Who has admin rights to your environment right now?
If the answer is “I’m not sure,” that’s the gap.
A privileged access review finds stale accounts, former employees who still have access, and admins with more than they need.
#CSaaS #AccessManagement
youtu.be/y2KIfOc4yEI?si=SiWV…
Most organizations need the same cybersecurity assessments every year, then buy them one at a time from different vendors.
CSaaS bundles five into one annual program: same team for three years, one price, no starting from scratch.
#CSaaS #Cybersecurity
youtu.be/7Jeufdj9Igo?si=--OJ…
Three ways to get ready for ransomware: a readiness assessment, an executive tabletop, or living through an attack.
Our new white paper, Tested, Not Just Written, follows one real engagement start to finish. Free, no form.
securanceconsulting.com/whit…
#Ransomware #IncidentResponse
600+ victims across critical infrastructure since 2024. CISA’s SafePay advisory doesn’t stop at patching and MFA. It says test: run your defenses against SafePay’s actual techniques and test your restores, since they wipe network-attached backups. Written isn’t ready.
SafePay ransomware has affected 600+ #CriticalInfrastructure orgs since 2024. Read our new advisory w/@FBI @SecretService & partners for IOCs + mitigations, including: patch edge devices, limit admin access & enforce multi-factor authentication 👉 go.dhs.gov/5rL
ALT The image features a dark digital theme with a glowing red lock in the center symbolizing cybersecurity. The text reads "#StopRansomware, Safepay Ransomware." Logos of the FBI, CISA, Secret Service, NCA Landeskriminalamt Rheinland-Pfalz, and the UK North West Regional Organised Crime Unit are displayed at the bottom.
Who clicks the phishing email, and what could they reach if they did? Those answers usually sit in two reports from two vendors who never compared notes. CSaaS runs both, plus three more assessments, with one team each year: securanceconsulting.com/serv…
#Phishing #Cybersecurity
Every incident response plan looks solid on paper. We've never seen one survive contact with a live scenario without at least one surprise. What's yours missing? #Cybersecurity #IncidentResponse #RansomwareReadiness
Another emergency NetScaler patch. A patch fixes the flaw. It doesn’t evict anyone who got in before you applied it.Patch, then hunt for indicators of compromise. If anything looks off, rotate credentials and session tokens. #NetScaler #CybersecurityAwarenessMonth
We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: bit.ly/4rWRBz4
We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.
The ransomware tabletops we run keep turning up a call tree with someone on it who left months ago, and a room where nobody's sure who can take a system offline at 2 a.m. Neither one shows up in a document review. #IncidentResponse
Full write-up: securanceconsulting.com/post…
At Black Hat 2026, a researcher pulled CI/CD secrets from the Anthropic, Google, and OpenAI coding agents, each tested against the vendor's own repo on default settings. Teams running them on defaults carry the same exposure. #AISecurity
expertinsights.com/news/rese…
Domain 6 of the Securance 11 is build vs. buy vs. embed. Buying or embedding an AI agent means running the vendor's default configuration until someone on your side reviews it. securanceconsulting.com/post…
Boards that wait for the first deepfake loss approve the callback control after the wire is gone. The policy is cheap to write. Testing it against a convincing CFO voice is what gets skipped.
#Deepfakes become a #board priority once an executive falls for one
buff.ly/9EIDhpQ
@HelpNetSecurity @Pindrop #tech #cybercrime #cyberthreats #cyberattacks #databreaches #business #cybersecurity #leadership #management #CISO #CIO #CTO #CEO #malware #AgenticAI #AIrisks
