William McBorrough
Washington, District of Columbia, United States
17K followers
500+ connections
About
I am a 20+ year cybersecurity industry veteran and small business cyber risk advisor…
Services
Articles by William
-
Is AI making traditional security obsolete?
Is AI making traditional security obsolete?
Anthropic recently announced that it is withholding public release of its latest AI model, citing concerns that its…
4 Comments -
Can GRC Engineering save Compliance Programs?
Can GRC Engineering save Compliance Programs?
In recent CMMC engagements, I am seeing a consistent pattern. Organizations invest heavily in documentation, evidence…
10 Comments -
JAPBI 2026 CMMC Updates
JAPBI 2026 CMMC Updates
Now that I’ve had some time to decompress from last week’s JAPBI 2026 conference, I wanted to share a few thoughts on…
6 Comments -
Compliance Is Not Security, But Done Right, It Can Make You More Secure
Compliance Is Not Security, But Done Right, It Can Make You More Secure
I often remind clients and students that compliance and security are different. A company might meet compliance…
5 Comments -
“Wow, You Guys Were Really Prepared.” Lessons from a Successful CMMC Level 2 Assessment
“Wow, You Guys Were Really Prepared.” Lessons from a Successful CMMC Level 2 Assessment
"Wow, you guys were really prepared!" Those are some of the best words you can hear when sitting across from a…
3 Comments -
Lessons Learned From the TAIMScore Assessor Workshop: Practical Insights on Governing AI Risk
Lessons Learned From the TAIMScore Assessor Workshop: Practical Insights on Governing AI Risk
I recently participated in Project Cerebellum’s Trusted AI Model Score (TAIMScore) Assessor Workshop. This intensive…
1 Comment -
Navigating the AI Augmented Threat Landscape: What You Need to Know in 2026
Navigating the AI Augmented Threat Landscape: What You Need to Know in 2026
Artificial intelligence has rapidly transformed the cybersecurity ecosystem, creating both unprecedented opportunities…
6 Comments -
Beware of Supply Chain Attacks this Holiday Season
Beware of Supply Chain Attacks this Holiday Season
I've been having a lot of "year-end" conversations with clients lately. Most are focused on closing projects…
3 Comments -
When Your Security Vendor Becomes the Single Point of Failure: Lessons from the Cloudflare Outage
When Your Security Vendor Becomes the Single Point of Failure: Lessons from the Cloudflare Outage
Two weeks ago, I wrote about the AWS outage and the lessons we can learn about change management. Here we are again…
1 Comment -
Beyond Money, Downtime, and Data Loss: Expanding the Cyber Risk Conversation
Beyond Money, Downtime, and Data Loss: Expanding the Cyber Risk Conversation
A few weeks ago, I sat in a meeting with a vCISO client listening to a vendor present a risk assessment. The slides…
10 Comments
Activity
17K followers
-
William McBorrough shared thisIn this SMB CISO Insights article, I challenge the “security first” mindset and explore why a mission-focused approach is the only way forward. Question: If not “security first,” what phrase best describes our role in enabling and protecting the mission? https://zurl.co/7mA4e #Cybersecurity #CISO #Leadership #MissionFirst #RiskManagement
-
William McBorrough shared thisAI vs AI is becoming the new battleground. Security strategy must evolve accordingly. In this SMB CISO Insights article, I break down how AI is enabling more sophisticated attacks and what CISOs and security teams can do now to stay ahead. #ArtificialIntelligence #AICyberDefense #ThreatLandscape #cybersecurity https://zurl.co/Gu0cwNavigating the AI Augmented Threat Landscape: What You Need to Know in 2026Navigating the AI Augmented Threat Landscape: What You Need to Know in 2026
-
William McBorrough reposted thisDerrich Phillips, Lead CMMC Certified Assessor, ATP
Derrich Phillips, Lead CMMC Certified Assessor, ATP
William McBorrough reposted this🛑 THE "WAIT AND SEE" ERA FOR CMMC IS OFFICIALLY OVER. The CMMC landscape is shifting fast. From massive budget increases to a tightening pool of authorized assessors, we are entering a "Perfect Storm." 🌪️ I’ve summarized the key takeaways from our recent Lead CCA Open Mic to help you stay ahead of the curve. Don’t get locked out of your next contract renewal. Alex O. William McBorrough Justin Johnson Dr. Michael C.The CMMC "Perfect Storm": Navigating the $1.5 Trillion Surge in the Defense Industrial BaseThe CMMC "Perfect Storm": Navigating the $1.5 Trillion Surge in the Defense Industrial Base -
William McBorrough reposted thisWilliam McBorrough reposted thisI’m pleased to announce the public release of the Trusted AI Model (TAIM) 4.0 framework this week. This release is a significant milestone for Holistic Information Security Practitioner Institute (HISPI) AI Governance Community of Practice - Project Cerebellum, on the 3rd year anniversary since this initiative was launched in April 2023. Trusted AI Model (TAIM) 4.0 includes a crosswalk to 2,800+ related AI incidents used to determine the HISPI Trusted AI Model (TAIM) Top 20 for Q1, 2026. This represents a scale of well over 200X from the previously mapped related AI incidents. Please visit https://lnkd.in/gawGq_RU to download the TAIM 4.0, as well as access the TAIMScore™ platform. TAIMScore™ is HISPI Project Cerebellum’s Trusted AI Model (TAIM) framework maturity assessment and risk management training (using gamified simulation) platform, providing guardrails for Safe, Secure, Responsible, and Trustworthy AI use cases.
-
William McBorrough shared thisSecurity leaders have a unique opportunity to champion AI adoption while ensuring it is done securely. Read my latest article on six strategies to help champion AI within your organization: https://zurl.co/sz9J6 #CISO #CyberSecurity #AI #AIGovernance #RiskManagementFrom Risk Managers to AI Champions: How CISOs Can Lead the Next WaveFrom Risk Managers to AI Champions: How CISOs Can Lead the Next Wave
-
William McBorrough shared thisIn this SMB CISO Insights article, I challenge the “security first” mindset and explore why a mission-focused approach is the only way forward. Question: If not “security first,” what phrase best describes our role in enabling and protecting the mission? https://zurl.co/7mA4e #Cybersecurity #CISO #Leadership #MissionFirst #RiskManagement
-
William McBorrough shared thisIn this issue of SMB CISO Insights, I revisit the Security vs. Compliance conversation. Compliance is not security. Most experienced practitioners know this. But the inverse is also true: when compliance is operationalized correctly, it can materially improve security outcomes. This article examines this tension from two perspectives that have shaped my career: those of a security practitioner and an auditor. https://zurl.co/be8aY
-
William McBorrough reposted thisWilliam McBorrough reposted thisNVBCC is growing—and we want you to be part of what’s next. This summer marks an exciting new chapter, and we’re building momentum in a big way. We’re entering a particularly dynamic season, with many new opportunities to connect, collaborate, and elevate your business through the Chamber, including our upcoming 4th Annual NVBCC Corporate Leadership Summit. In the coming weeks, we’ll be unveiling a refreshed website and a completely reimagined digital member experience—designed to make engagement easier, more meaningful, and more impactful than ever before. If you’ve recently joined, you’ve come in at exactly the right time. If you’re already a member but haven’t been fully engaged, now is the moment to plug back in. And if you’ve been considering membership, this is your signal—the NVBCC experience is evolving, and the value is growing with it.
-
William McBorrough shared thisIn this SMB CISO Insights article, I challenge the “security first” mindset and explore why a mission-focused approach is the only way forward. Question: If not “security first,” what phrase best describes our role in enabling and protecting the mission? https://zurl.co/7mA4e #Cybersecurity #CISO #Leadership #MissionFirst #RiskManagement
-
William McBorrough reacted on thisWilliam McBorrough reacted on thisThe Virginia Commonwealth University - College of Engineering recently launched the Software Engineering Center to teach the next generation of software engineers the best way to build software. Supported by more than $3.5 million in National Science Foundation (NSF) funding, the Software Engineering Center at VCU reflects the growth of research and collaboration at the College of Engineering. Read more: https://lnkd.in/e5vJSjPS
-
William McBorrough liked thisWilliam McBorrough liked thisWe raised a question during a recent CyberAB Weekly C3PAO discussion that sparked a much broader conversation across the CMMC ecosystem: Too many companies in the DIB assume that hiring a “CMMC-certified” MSP automatically means their environment is compliant. That assumption is becoming one of the biggest hidden risks in the ecosystem. Shared responsibility, inherited controls, enclave boundaries, evidence ownership, and customer responsibilities are being misunderstood every day — especially by SMB manufacturers and subcontractors. We broke down the growing “inheritance problem” and why organizations are discovering gaps far too late in the process. As CMMC continues to mature, discussions like these are exactly what the ecosystem needs. Additional guidance and clarification are expected as implementation realities continue surfacing across OSCs, MSPs, RPOs, and C3PAOs. Read here: https://lnkd.in/gtPP684k #CMMC #CMMC2 #Cybersecurity #DIB #DefenseIndustrialBase #NIST800171 #MSP #MSSP #Compliance #FedRAMP #GovCon #DoD #CyberRisk #CUI #Aerospace #Manufacturing #AceOfCloud #ExternalServiceProvider #ESP
-
William McBorrough reacted on thisWilliam McBorrough reacted on thisBig milestone for Bridgecross LLC 🇺🇸 We’ve officially received a DCAA Accounting System Approval with an Unqualified Opinion — the highest rating. ✔ Fully compliant with SF 1408 ✔ Approved for cost-reimbursable (CPFF) contracts ✔ Audit-ready with no findings This is a major step forward as we continue supporting federal missions and expanding our footprint. #GovernmentContracting #DCAA #AuditReady #SDVOSB #FederalContracts #SmallBusiness #GOVCON
-
William McBorrough liked thisThank you to all who stopped by at Techtextil . The discussion were beyond productive. It was an absolute pleasure to see old friends, make new ones, and catch up on the latest innovations.William McBorrough liked this𝗧𝗘𝗖𝗛𝗧𝗘𝗫𝗧𝗜𝗟 𝟮𝟬𝟮𝟲: 𝗜𝗻𝗻𝗼𝘃𝗮𝘁𝗶𝗼𝗻, 𝘀𝘂𝘀𝘁𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗮𝗻𝗱 𝗽𝗿𝗼𝗺𝗶𝘀𝗶𝗻𝗴 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻𝘀 From 21–24 April 2026, we welcomed our visitors to our booth at Techtextil in Frankfurt. Thank you to everyone who joined us — your interest, questions and collaborative spirit made this event a success for us! 🙌 𝗞𝗲𝘆 𝗵𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀 𝗮𝘁 𝗼𝘂𝗿 𝗯𝗼𝗼𝘁𝗵: ✅ 𝗦𝘂𝘀𝘁𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗮𝘀 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱: We demonstrated how eco-friendly materials and processes can meet performance demands without compromise. 🌿 ✅ 𝗜𝗻𝗻𝗼𝘃𝗮𝘁𝗶𝗼𝗻 𝗦𝗽𝗼𝘁𝗹𝗶𝗴𝗵𝘁: The Hydro-Stitch 'Welding without Plastic' technology was a particular highlight, generating significant interest in its plastic-free seams created using high-pressure water jets. 🪡💧 ✅ 𝗧𝗮𝗶𝗹𝗼𝗿𝗲𝗱 𝗲𝘅𝗽𝗲𝗿𝘁𝗶𝘀𝗲: Our Protective, Performance, Cleaning and Filtration teams shared insights on customized solutions for your specific applications. Thank you to our customers, partners, and new connections! Let's continue the conversation and 𝗷𝗼𝗶𝗻 𝘂𝘀 𝘁𝗼 𝗴𝗿𝗲𝗲𝗻 𝗼𝘂𝗿 𝗳𝘂𝘁𝘂𝗿𝗲 by developing sustainable, bio-degradable, and durable material solutions. #TECHTEXTIL2026 #Norafin #Nonwovens #HydroStitch #Weldingwithoutplastic
-
William McBorrough liked thisWilliam McBorrough liked thisWe’re feeling a little richer today… and next Monday, one golfer might actually be 💰 At the beautiful TPC Potomac at Avenel Farm, a lucky participant in the R3 LLC Charity Golf Tournament will have a shot at walking away with $1,000,000, all thanks to our Million Dollar Shootout Sponsor, Secure Halo™, a Mission Critical Partners company. Their support doesn’t just raise the stakes; it helps us raise critical funds for the Colorectal Cancer Alliance and the incredible work they do every day. 🎯 Big swing. Bigger impact. Thank you, Secure Halo™, for bringing the excitement and for making a meaningful difference. About Secure Halo: Secure Halo™, a company of Mission Critical Partners, is a leading provider of advanced risk management and mission assurance solutions designed to protect people, assets, and operations in complex environments. Leveraging cutting-edge technology, real-time intelligence, and deep operational expertise, Secure Halo empowers organizations to proactively identify threats, enhance situational awareness, and ensure continuity across critical missions. Their commitment to innovation and security makes them a trusted partner for organizations where failure is not an option. #CharityGolf #MillionDollarShot #SecureHalo #MissionCriticalPartners #R3Charities #ColorectalCancerAlliance #GolfForACause
-
William McBorrough liked thisWilliam McBorrough liked thisConstruction Safety Week reminds us that the practice of safety is the responsibility of all of us…every day, on every job. This year, the focus is on three simple but powerful actions: Recognize the risks, Respond with intention, and Respect the people around you. Especially in high-energy, high-hazard work, these choices can mean the difference between a close call and a life-changing event. We’re ‘All In Together’. Let’s stay alert, look out for one another, and make sure everyone goes home safe. #ConstructionSafetyWeek #RecognizeRespondRespect #RiverCityConstruction
-
William McBorrough liked thisWilliam McBorrough liked thisHad a great time with friends from Nuvolo at the Servicenow Knowledge 2026 Conference. It was exciting to learn about the Nuvolo Connected Workplace's various AI Agents designed to enhance Facility Asset Maintenance and Space Management efficiency, leading to high performance and other beneficial outcomes.
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
Licenses & Certifications
-
-
Certified Minority Business Enterprise
Capital Region Minority Supplier Development Council
IssuedCredential ID CR35773 -
-
-
-
-
Volunteer Experience
-
Founding Member
CMMC Professionals Network (CPN)
- Present 9 months
The CMMC Professionals Network is a community for cybersecurity professionals at all levels, dedicated to advancing careers in CMMC compliance. Whether you aim to become a CMMC Certified Assessor (CCA), provide consulting services, or deepen your expertise, we offer support through education, mentorship, and collaboration.
-
Regional Vice Chair - District of Columbia , MBE Input Committee
Capital Region Minority Supplier Development Council
- Present 4 years 5 months
The Minority Business Enterprise Input Committee is a group of certified Minority Business Enterprise (MBE) representatives who provide counsel and recommendations so that programs and projects implemented by CRMSDC are relevant and supportive of minority business development.
-
Technology Editor - THRIVE Magazine
Northern Virginia Black Chamber of Commerce
- 1 year
THRIVE Magazine is dedicated to bringing our network timely and valuable business information designed for success. THRIVE is committed to providing resources, leadership, and advocacy to promote the African American community's prosperity.
-
Strategic Partnerships - Project Cerebellum
Holistic Information Security Practitioner Institute (HISPI)
- Present 2 years 10 months
Project Cerebellum is a HISPI Think Tank designed to crowdsource an open-source product. Our vision is Serving Safe and secure AI, while our mission is to be the brains behind the promotion and harmonization of best practices, standards, and frameworks for AI and related technologies.
-
Global Advisory Board
EC-Council
- Present 1 year 7 months
Education
The EC-Council Global Advisory Board for Penetration Testing is a collective of esteemed cybersecurity professionals and industry leaders from various sectors and globally recognized organizations. This board provides strategic guidance to EC-Council, particularly in the development and enhancement of penetration testing initiatives, including the Certified Penetration Testing Professional (C|PENT) program. Members contribute their expertise to ensure that EC-Council's offerings remain relevant…
The EC-Council Global Advisory Board for Penetration Testing is a collective of esteemed cybersecurity professionals and industry leaders from various sectors and globally recognized organizations. This board provides strategic guidance to EC-Council, particularly in the development and enhancement of penetration testing initiatives, including the Certified Penetration Testing Professional (C|PENT) program. Members contribute their expertise to ensure that EC-Council's offerings remain relevant and effective in addressing current cybersecurity challenges.
-
Recommendations received
20 people have recommended William
Join now to viewOther similar profiles
Explore more posts
-
SNH TECHNOLOGIES
🚨 70% of small businesses close within 6 months of a major cyberattack. Don’t be a stat. A resilient business doesn’t just back up data. It defends, detects, and adapts. You need proactive monitoring and real-time threat intelligence so you don't just recover from a cyberattack—you resist it.
-
Robert W.
Vulnerability Summary for the Week of November 10, 2025 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard....
-
Jeff Baldwin, DSc
This is a fantastic resource and a well done document. There is a new CMMC FAQ. One question in the new FAQ stuck out to me: "Q4. Can Department contractors implement NIST SP 800-171 Revision 3? A4. Yes. Companies can implement Revision 3 but must use the Department’s Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum, “Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3” found here: https://lnkd.in/eN5pnTzB. Because CMMC Assessments will be conducted against Revision 2 until the class deviation memo (Q3 of this section) is withdrawn or otherwise superseded, DIB companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed." We won't know exactly when the class deviation will removed and CMMC will be on 800-171 Rev 3, but if you want to get a headstart you are permitted to implement Rev 3 if you use the DoD's Organizationally Defined Parameters (ODPs). I will note that the ODPs are subject to change during the rulemaking process. #cmmc
-
On Call Compliance Solutions
𝗕𝘂𝗹𝗹𝗲𝘁𝗽𝗿𝗼𝗼𝗳 𝗬𝗼𝘂𝗿 𝗦𝗦𝗣 𝘄𝗶𝘁𝗵 𝗘𝘃𝗶𝗱𝗲𝗻𝗰𝗲 Want to survive CMMC or DIBCAC without surprises? Write your SSP by assessment objective and link evidence to each one. Clear proof beats “interpretation” every time. Simple. Defensible. Effective. #CMMC #NIST800171 #CyberSecurity #Compliance
-
Virtual Service Operations
Post 6: Audit-Ready Operations "Are you ready for your CMMC assessment?" Wrong question. Right question: "Are your daily IT operations generating audit-ready evidence?" VSO's managed services are built compliance-first: Security monitoring with documented analysis Infrastructure changes with evidence trails Incident response with compliance reporting Configuration management with baseline tracking We don't prep you for audits. We operate audit-ready systems. Learn more at: https://vso-inc.com/cmmc/ #CMMC #ManagedServices #Compliance
-
Dr. Darren Death
In my new article published by ICIT, Executing the RMF as an Engineering Discipline, not a Paperwork Exercise, I discuss how the Risk Management Framework must function as part of engineering, not as a compliance process. RMF was created to align design, implementation, and operations so that control performance is demonstrated through verified system behavior rather than documentation. The article explains how integrating RMF into development pipelines, architecture decisions, and operational telemetry allows authorization decisions to reflect real conditions in production. When security is designed, tested, and monitored as part of engineering, the framework delivers what it was meant to provide. Systems maintain authorization by demonstrating continued security in operation. Read the full article on ICIT: https://lnkd.in/eup93tvi #cybersecurity #technology
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content