That is a leadership and management requirement, not something structural separation can solve on its own. Cybersecurity may be undermanaged, not just underfunded Security spending tells a similar story. Cybersecurity investment has risen substantially over the past decade, and some… Read More "Cybersecurity is a leadership problem: Why the management model needs to catch up"
There’s an old leadership fantasy that goes something like this: The CISO surveys a sprawling technology estate, discovers 11 tools doing the work of four, calculates the licensing savings, selects a shiny new strategic platform and declares that consolidation has… Read More "These ARE the droids you’re looking for"
Detection engineering follows the same pattern. A rule that produced useful signals 18 months ago may generate mostly benign activity today. New attacker techniques may also create gaps that did not exist when the rule was written. Continuously evaluating detection… Read More "When building an AI-native security program, start with outcomes"
The wall, and the crack in it The kits that matter now are adversary-in-the-middle proxies. Rather than serve a fake login page, they relay the victim’s traffic to the real Microsoft sign-in service in real time, hand the real responses… Read More "We are fighting phishing at the wrong layer"
Yet interoperability does not guarantee factual accuracy or operational use. Collection tools may disagree about components and dependency paths. A valid document may describe source code but not the released binary, the approved architecture but not the running deployment, or… Read More "Your enterprise doesn’t need six BOM programs. It needs one evidence graph"
The fastest-growing category of enterprise software right now is also the least scrutinized from a security standpoint. AI application platforms — tools that let teams build, connect and automate AI-powered workflows without writing much code — are landing in production… Read More "The AI app builder your team trusts has a root-level backdoor"
Despite widespread concern about the negative potential of AI technologies, many cybersecurity leaders disagree on the scope of these threats and how to mitigate them. Amodei didn’t help his argument by using an impossible example of a swarm of AI… Read More "Pacing the AI frontier won’t solve agentic cybersecurity’s most urgent problems"
Gartner recently released a new category of security tools: the Integrated Security Operations Center (ISOC). This new category acknowledges the need to expand beyond traditional SIEM tools in the creation of a security portfolio, though, as they note in the… Read More "What exactly is ISOC? And what does it mean for you?"
But if we look at what the research already does. In Winter Soldier, a team poisoned under 0.005% of pre-training tokens, 64 documents and made a model learn a hidden prompt-and-response pair that never appears in the training data at… Read More "Rolling the cyber dice with open-source and open-weight AI models"
There is an interesting story about a French dog on the banks of the Seine river that helps us understand misbehaving AI agents. The dog is trained to save children from drowning. He succeeds and is rewarded, becoming an overnight… Read More "Why AI agents are like the dog that pushed kids into the Seine"
