CISO's perspective from the frontlines
If you’ve been in cybersecurity long enough you remember the mantra of “defense in depth”. “Defense in depth” meant bigger firewalls, more appliances, and a thicker stack of tools protecting the data center. These days, in the age of AI, cybersecurity defense feels less like building a fortress and more like trying to drive a battle tank through a sky full of cheap...
How Humans Learn, How Machines Don’t, and What That Means for the Next Generation of Cybersecurity Practitioners In Part 1 of this series, we traced how AI in cybersecurity went from an academic curiosity to a marketing buzzword, and finally to something genuinely new with the arrival of Large Language Models (LLMs) and the need for developing AI Literacy. But there’s a bigger...
What is AI Literacy and why every security practitioner needs to have it? Is it the ultimate new skill in cybersecurity? If you just dropped into the security industry today and are listening to the chatter, you’d be forgiven for thinking that AI in cybersecurity was invented in the last couple of years. Every vendor, analyst, and conference keynote talks about it like it’s a brand-new thing. But...
You would think this is a reasonable question to ask security vendors that are pitching you their product. I would also think the vendor will be able to answer it quite easily. Think again! Every vendor can tell you what they do 100%! Some times they can even tell you how they do it. But what I found was that they almost never can tell you what problem they are solving. My LinkedIn post Several...
In this episode of Defense in Depth, I joined David Spark and Mike Johnson – CISO at Rivian to discuss the topic of vulnerability management. We make the argument that simply finding vulnerabilities is not enough, and true vulnerability management requires prioritizing, tracking, fixing, and assessing risks. What we need is a comprehensive approach that includes IT hygiene, asset...
Have you ever wondered why many security strategies look more like a BINGO card than actual strategy? Organizations are still rarely proactive about cyber security. Usually something triggers organizations’ decision to invest in cyber security, whether they suffered a breach, they are required to do so by some regulations, their clients demanding it, or they decide to IPO, just to name a...
Once upon a time in a company far far away Several years ago, in a different organization, my team and I successfully implemented a Vulnerability Management program. It was a massive undertaking, taking over a year to complete and sizable budget. Our goal was to continuously scan over 100,000 devices and automate the reporting of findings to relevant teams. The project went beyond reporting by...
Discovery of security issues is important, but ultimately we need to remediate them. So why do so many solutions seem to stop short?
In this episode of Defense in Depth, I joined as a guest co-host to David Spark (@dspark), the producer of CISO Series, and our guest, Neil Watkins, SVP technology and cybersecurity services, i3 Verticals.
Trust is the bedrock of any successful and healthy relationships. In organizations, it fosters collaboration, empowers team members, strengthens decision-making, and inspires confidence in leadership. Building trust takes time and consistent effort, but the rewards are a culture of transparency, accountability, and a workforce that is both motivated and secure. Therefore it is critical for CISOs...
In this episode of CISO Series, Cyber Security Headlines, I am reviewing this week’s cyber security headlines and stories with Richard Stroffolino. We talked about: Vulnerability in Apple’s Silicon M-series chips can’t be patched APT31 uses family members to surveil targets MFA bombing attacks target Apple users Think tank calls for US military cyber service Google recommends scam sites Spyware...
CISO's perspective from the frontlines