← Feed

Posts

• Post #4169276

  "Lately I've noticed the CISO role splitting into two: a tall goof with a fancy resume who pontificates at length and something something 'understands how to talk to business', and someone technical to actually do the job..." 1. You haven't noticed that "lately", that’s been a bad strategy for 20 years. 2. Why are retired execs dropping these "epiphanies" now? What’s with retired CISOs espousing these "theories"? Are you subtly admitting...

• Post #3419714

  This is damning... "The only trait that consistently predicted objections to remote work was narcissism — the tendency to be self-centered and entitled. The higher the opinions of themselves leaders expressed, the more they coveted power and status — and the more they favored return-to-office mandates." https://www.nytimes.com/2026/06/22/opinion/office-work-wfh-bosses.html

• Post #1787844

  @jackryder @wendynather Absolutely...

• Post #1787843

  This was the promise 25 years ago. Why do I need a half dozen streaming services now? https://www.youtube.com/watch?v=xAxtxPAUcwQ

• Post #1787842

  AI’s impact in security and its application are not always aligned - AI for security, or using large language model capabilities to improve security tooling, is permeating several organizations’ security product categories, a recurring theme since generative AI copilots emerged in 2023. When asked where teams are using LLM-enhanced security in their tooling and processes, the top responses are for malware detection and analysis (as in extended or endpoint detection and response), automated res...

• Post #1787841

  "Doing my first ever CFP, and... ...I'm going to do a few more before inflicting the world with my ridiculous generic advice." ...said no one ever.

• Post #1787840

  If you write ‘recognized thought leader’ in your bio, I think you should also list three people who will swear to it on your behalf.

• Post #1787839

  If a prevailing theme at RSAC 2025 was the role of co-pilots to leverage large language model capabilities in security tooling via a chat interface, RSAC 2026 considered agentic AI in situations where the price of hallucinations may be a wrong or destructive autonomous action in a live production environment. Much of "security for AI" today consists of guardrails in a chat context; similarly, the first stages of AI in code creation consisted of auto-complete. Without necessaril...

• Post #1549968

  It's interesting listening to people who historically criticized 'FUD', or using fear, uncertainty, or doubt to sell security tooling, uncritically talk about how the damage a Frontier AI model they've never used or seen used will be profound and that it is going to 'change everything'. This is all based on only the analysis of the vendor selling that AI model. And also you can't see it, because it's 'too dangerous&#3...

• Post #1113517

  For the love of all that is holy, please before releasing your new acronym on the world, do a quick Internet search. The preceding message is mostly meant for a certain kind of analyst.

• Post #1009101

  "It's going to get much worse. Just look at generated code, right? I mean, pull requests are getting bigger. The vulnerability mix is changing. It's not going down. How do we deal with that? How do we let people safely generate code from prompts?" said Daniel Kennedy, principal research analyst at 451 Research, part of S&P Global Market Intelligence. As a solution, he offered a brake metaphor. "A lot of people think brakes are for stopping cars...

• Post #924473

  So again...we're ok with autonomous AI in these scenarios because 'that's what the enemy will do', or the rule of law, or something, even though one of the big AI innovators, maybe the big one when it comes to actual technical chops, says it's definitely not ready for that and he's now unintentionally in a pissing contest with an ex-cable news host? I mean, you know it's not in his business interest to publicly say it's not ready,...

• Post #924472

  RE: https://infosec.exchange/@danielkennedy74/116133378608952412 Also, it will never be ready for not having a 'human in the loop' when it comes to lethality, and I'm not sure why a whole lot of innocent people will have to die to come to that conclusion. The script to Terminator isn't a defense plan. We can just, you know, think ahead, and start writing the mutual arms treaties now.

• Post #924471

  @cR0w Incredible reference, the ultimate human in the loop, possibly saved the world and there isn't a single statue dedicated to him.

• Post #924470

  RE: https://infosec.exchange/@SheHacksPurple/116133467021175625 Hoping and vibing isn't a strategy.

• Post #924469

  @krypt3ia It drew me in. The first two episodes, I felt like I was watching someone with a GoPro at a Ren Faire. But the acting, especially the character of Aegon, really landed. I will confess I was annoyed they strayed from the books in the finale by having Egg sneak off again. Having Maekar, after unintentionally killing his brother and acknowledging the failures in raising his other sons, agree that Aegon could be squire to a hedge knight, and all that entailed, was an important plot point...

• Post #924468

  And in 'easily predictable outcomes' news, thanks again chainsaw guy, will mop person ever be making an appearance? https://techcrunch.com/2026/03/10/doge-employee-stole-social-security-data-and-put-it-on-a-thumb-drive-report-says/

• Post #924467

  At the airport: Is this the end of the group 2 line? “I don’t know, I’m group 5, I just get on whatever line.” /returns to cell phone call “So anyway, I got a full scholarship to the best MBA program in the country.” —- Provides some idea of how business decisions get made…

• Post #924466

  Next in Tech | Ep. 259: The RSAC Conference – Agents on The Loose. https://www.spglobal.com/market-intelligence/en/news-insights/podcasts/next-in-tech/next-in-tech-ep-259-the-rsac-conference-agents-on-the-loose

• Post #924465

  𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗳𝗼𝗿 𝗔𝗜 𝗶𝘀 𝗰𝗿𝗲𝗮𝘁𝗶𝗻𝗴 𝗮𝗻 𝗲𝘅𝗽𝗲𝗿𝘁𝗶𝘀𝗲 𝗽𝗮𝗿𝗮𝗱𝗼𝘅 Three years ago, early generative AI integrations in security operations platforms primarily took the form of chat interfaces within their tooling ecosystem. These interfaces enabled natural language queries, incident summarization and the potential automation of routine investigative tasks. Vendors framed early use cases around the ability to uplevel junior or Tier 1 analysts in security operations centers (SOC). Several years into broader GenA...

• Post #924464

  Let me Delve into this SOC2 report you just sent...

• Post #924463

  Seen on the floor #RSAC2026, solid NJ band. Fun fact, they used my old basement TV in one of their videos. Well, fun for me anyway…

• Post #924462

  Honestly, in a sea of lame superficial AI labor replacement takes, it was refreshing to see something at #RSAC that drives at an outcome that will actually resonate with SOC folks. “Christ you’be gotten big, Timmy. What’s that glowing yellow thing that’s hurting my eyes?”

• Post #924461

  For the past three years, one of the highlights of my week at #RSAC has been joining @euroinfosec in the Information Security Media Group (ISMG) studio to talk about the intersection of my research and the security themes we’re seeing emerge at the conference: https://www.bankinfosecurity.com/multi-cloud-security-straining-ciso-teams-a-31240

• Post #924460

  While I’ve been in the trenches for a few decades now, my feed is not one of management advice usually. But here’s one: Don’t be the “let’s take this offline” person, when something is getting resolved in real time with a little passion or because you don’t like difficult questions. The ball must move forward. It’s wildly unimpressive. It’s really bad if everyone then ignores you. If you want to schedule something in a smaller focused group, say that, in a specific way, with timing.