Activity
11K followers
-
Ed Bellis reposted thisEd Bellis reposted thisCome join my team at OceanFirst Bank, where we are leading multiple cybersecurity initiatives in support of a growing enterprise. This is a great opportunity to collaborate with a talented group of professionals. For further details, feel free to reach out. No recruiters please.
-
Ed Bellis reposted thisEd Bellis reposted thisJoe Sullivan and I spent the morning riffing on Mythos and synthesizing the conversations we've been having with folks across the industry over the last 24 hours. The short version: machine-speed zero day discovery, even of the most hardened infrastructure, breaks almost every assumption cyber has been built around. A great cyber rewrite is needed. What survives, what gets commoditized, and how we might need to rethink shipping software from first principles is what the post below is about. Shared-surface vs company-specific control, why local context is the product, mass deprecation versus patching, why bespoke infrastructure may be a real defensive moat again, and a few heretical ideas in between. Would love to hear where people think we have it wrong!
-
Ed Bellis reposted thisEd Bellis reposted thisTons of discussion lately about how Mythos will reshape vulnerability management. Most of that has focused on Mythos' capabilities to detect vulns and develop exploits at a scale and pace never before seen. While that's the headline outcome, I'm far more interested in the net effect on attacker-defender advantage. What's that? Here's a post summarizing the concept: https://lnkd.in/daJT4S79 In a nutshell, it measures the relative momentum between attackers exploiting vulnerable systems and defenders remediating them. Many factors alter the advantage one way or the other. One major determining factor is when exploit code is released. Per the chart below, defenders have a solid advantage when a patch is available before an exploit is published. But when exploits begin before systems can be patched, the story is much different - attackers gain the upper hand. This is what I'm most interested in seeing what happens with Mythos. I see two opposing outcomes as possible: 1. Whether by intention or accident, Mythos leads to far more exploits being released before vulns are patched. This will be very bad for defenders. 2. Project Glasswing actually works, and the major vendors collectively stay ahead of exploit releases. I wish I could say, "This will be very good for defenders." But I don't see any realistic outcome of all this that makes things better for defenders. The best-case scenario here is that Project Glasswing maintains the status quo, and the attacker-defender advantage won't swing wildly in favor of attackers. Unfortunately, I think we're headed for something closer to Outcome #1. What say you?
-
Ed Bellis posted thisSat down with Mehul Revankar for a wide-ranging conversation, and it ended up being one of my favorite interviews in a while. We got into: → The early days of Kenna Security. What we got right, what we got wrong → The hard parts of scaling that don't make it into the press releases → The Cisco acquisition, and what EOL actually feels like from the inside → Where risk-based vulnerability management goes from here → The mythos debate (you'll have to watch) → Why AI is eating your scanner and a preview of what we're building at Empirical Security to meet that head-on If you've been in the exposure management trenches, or you're trying to figure out where this space is headed, I think you'll get something out of it. Link in comments.
-
Ed Bellis shared thisReally enjoyed this conversation on the Noise2Signal interview series. We covered a lot of ground. The early days of Kenna Security, the realities of scaling, the Cisco acquisition and EOL, where RBVM is headed, the mythos debate, our future at Empirical Security and how AI is reshaping vulnerability scanning. Thanks for the thoughtful questions and the kind words. Worth a watch if any of these topics are on your mind.Ed Bellis shared thisExcited to welcome Ed Bellis to the Noise2Signal interview series. This was a fun interview. I’ve watched Ed grow and scale companies for many, many years, sometimes as a competitor, and other times as a partner integrating into his products. In some respects, I actually got into building products because of Kenna. I share a funny anecdote on that in the episode. Now, some might say that was ultimately a bad thing, because the world had to suffer my products 😂. Regardless, this was a fun interview. Go watch it! Here are some highlights : - Early Days of Kenna Security - Challenges scaling Kenna - Kenna's acquisition by Cisco, and eventual EOL - Future of RBVM - Mythos Debate - And finally, AI is eating your scanner. Full Episode : https://lnkd.in/exaiBJqe
-
Ed Bellis shared thisGot my copy of The AI Security Handbook by Caroline Wong. I might be bias but I’m particular fond of chapter 6. “Global exploit prediction models like EPSS offer powerful,scalable insights derived from widespread exploitation telemetry. But not every vulnerability poses the same risk in every environment. This is where the concept of local models becomes essential.” Hard to argue that. And thanks for the props to our very Jay Jacobs & Michael Roytman.
-
Ed Bellis reposted thisEd Bellis reposted thisReading a good piece from Empirical Security this morning. Short version: EPSS is the current best answer for figuring out what vulns you should actually fix. It tells you which CVEs are actually being exploited in the wild, which is a much better signal than a severity score. Anthropic’s security team just officially blessed it. Empirical is the team that builds it. Catch is EPSS is a global model. It sees what attackers are doing on the internet. It does not see your environment, your controls, or which box would actually hurt if it got popped. That last mile is what Empirical is working on by training models specific to you and your environment - pairing it with EPSS and making magic. Read more - I think this is the future: https://lnkd.in/gw7Bxein #sponsorAnthropic Is Right About EPSS. That Still Leaves the Hard Part. | Empirical SecurityAnthropic Is Right About EPSS. That Still Leaves the Hard Part. | Empirical Security
-
Ed Bellis reposted thisEd Bellis reposted thisRSAC was a few weeks ago now, already starting to feel like a distant memory. But the conversations? Those have stuck. Our latest report, Voices From the Ground Floor, spotlights the early-stage founders quietly making waves across the industry: 🔹 Shlomie Liberow | aisy 🔹 Yair Grindlinger | Surf AI 🔹 Michael McLaughlin | VeridatAI 🔹 Ed Bellis | Empirical Security These are the builders shaping where cybersecurity goes next. Link in the comments 👇
-
Ed Bellis reposted thisEd Bellis reposted this🚨 Resilient Cyber Newsletter #94 🚨 Just another dull week in cyber, right? 🙃 📊 Cyber Leadership & Market Dynamics Axios broke a story that the NSA is using Mythos, despite the blacklist, while the Office of Management and Budget claims they aren't giving access to Mythos for agencies. Speaking of Mythos, Bloomberg shared a story that unauthorized users are already using Mythos, beyond those authorized via Glasswing. JPMorganChase shares a comprehensive playbook for CISO's and security teams to be AI-ready and cyber resilient. Artemis Security launches with a $70M Seed and Series A round led by Felicis and Spectrum Security launched with a $19M Seed round (cc: Dylan Williams). 🤖 AI OWASP GenAI Security Project shares their GenAI Exploit Roundup moving from theoretical risks to real-world exploitation. OX Security shares the "Mother of all AI Supply Chains" with an MVP vulnerability and 30+ disclosures. Karl McGuinness discusses how Agent Auth (AAuth) gets a "Mission Layer" and Material Security lays out how the legacy OAuth detection model doesn't survive AI agents, speaking of which, OAuth tokens are tied to the Vercel incident. OpenAI releases their open-weight privacy filter. 🪲 AppSec Speaking of Anthropic's Mythos, Mozilla says the zero-days are numbered, as they tackle 271 Mythos-Discovered bugs in their latest release and Patrick Garrity 👾🛹💙 does the due diligence to track Mythos-related CVEs. Kurt Boberg and the Semgrep make the case that open-source and flagship models can't exactly replicate Mythos ability to find needles in haystacks so easily. Anthropic recommends organizations lean on EPSS for Vuln prioritization by as Ed Bellis and Empirical Security demonstrate, local context is key not just global probabilities. National Institute of Standards and Technology (NIST)'s NVD essentially throws in the towel on CVE enrichment. All of this and more. As always, be sure to subscribe and share with a friend! https://lnkd.in/eRhAXrSb #ciso #cyber #ai #appsec
-
Ed Bellis liked thisEd Bellis liked thisMiami native and 2026 NFL Draft top pick Fernando Mendoza committed $500,000 to launch the Mendoza Family Fund, supporting multiple sclerosis research in stem cell transplantation at UHealth and the Miller School of Medicine. bit.ly/42jeaC6 University of Miami Health System, University of Miami Miller School of Medicine
-
Ed Bellis liked thisEd Bellis liked thisWe are so stoked to welcome Valerie Layman to the BizTrip family as Head of Product Strategy! Valerie brings deep expertise across corporate travel, technology, and product innovation at a time when the industry is rapidly evolving with AI. Huge addition to the team as we continue building the future of agentic travel. More here: https://lnkd.in/gJt2byDh
-
Ed Bellis liked thisAfter an incredible decade on the Bitsight executive team I'm returning to my first love, venture capital. I've joined Venture Guides as a Partner, focused on seed-stage founders tackling the rapidly changing world of enterprise cybersecurity. While I benefit from the experience of more than 100 venture investments and 20 Board seats, my time at Bitsight is the best demonstration I have of my commitment to the entrepreneurs I support. I met Bitsight’s founders, Nagarjuna Venna and Stephen Boyer in 2012 just after they hired their first employee. I worked with them for a year before leading their Series A. In 2016, I took the full plunge onto the executive team because I believed so much in what we were building. After a decade working alongside them and the rest of the executive team, surpassing $200M ARR with 3,500 customers worldwide, I felt the team, including Bitsight’s new CEO, John Clancy, are beyond the stage and scale where I can best contribute. I can’t thank Nagarjuna and Stephen enough for letting me share their journey to date and look forward to continuing to support them on their Board. Now I'm focused on what's next. AI is rewriting enterprise cybersecurity, and the best founders have never had more opportunity. As I take on this new role, my partner, Sage Nye, had me on our Built Not Born podcast to talk through my journey so far, where I'm heading, and what it's like to work with me as an investor. I’m grateful to Sage for the conversation. Watch Sage and I discuss what I have learned in my 30+ years of investing in more than 100 companies, 20 Board seats, 40 exists (I am just getting started 😊) and why I chose Venture Guides to return to my first Love, venture capital. Cybersecurity seed stage entrepreneurs, take a look and please reach out if you think I can help you. Link below 👇Ed Bellis liked thisVenture Guides is thrilled to welcome Dave Fachetti to Venture Guides as our newest Partner. What makes Dave special isn't the track record (though it's remarkable). It's the conviction and dedication to the founders that he works with. This is someone who met Nagarjuna Venna and Stephen Boyer in 2012, led Bitsight's Series A, then went all-in as an operator in 2016 because the mission demanded it. A decade later: $200M+ ARR, 3,500 customers, and a company built to last. Dave is not just an investor. He's a builder who happens to write checks. To mark the move, Dave joined Sage on the Built Not Born podcast for a wide-ranging conversation: 30+ years of lessons, what great founders look like up close, and why now is the moment to bet on cybersecurity again. The category is being rewritten in real time, and the founders attacking it deserve a partner who's actually been in the chair. If you're a seed-stage cybersecurity founder, this episode is for you. And Dave wants to hear from you. Link below 👇
-
Ed Bellis liked thisEd Bellis liked thisLast Thursday was bittersweet. I shut my AlphaSense issued MacBook Pro for the last time. One simple motion concluded an adventure that started at Canalyst a little over 8 years ago. Last Fall my family enrolled in a year of Boundless Life. We've spent 3 months each on the Greek island of Syros and in LaBarra, Uruguay. I'm now writing this from Estepona, Spain and the plan is to be in Pistoia, Italy this coming Fall. Being in cohorts with Boundless co-founders Mauro Repacci, Rekha Tak Magon and their families has given me a unique glimpse into how people are evolving the way to think about education. My family started this year of worldschooling with the goals of living a simpler life (everything had to fit in a suitcase and a backpack), experiencing world cultures, and not losing sight of living in the present. We're still figuring it all out, but the one-year experiment is going so well that we're choosing to extend it into a two-year experience. My professional life over that 8 year period was a wild ride through early startup days, the pandemic, the acquisition of Canalyst by Tegus in August 2022 and then less than two years later, AlphaSense acquiring Tegus. Thank you Damir Hot, James Rife and Ben Rabinovitch for insisting there were interesting technical challenges to be solved in financial modeling (beyond battling with Excel) and having the trust to let me lead the Engineering team. Thomas Elnick, Michael Elnick, and Bob Casey showed me that passion and energy for building a business are infectious. Special thanks to Lionel Barrow, the best Co-Head of Engineering anyone could ask for as we leaned into the Tegus value of "the best team wins". Together we integrated Canalyst and Tegus engineering and took it to the next level. At AlphaSense I saw the vision Jaakko (Jack) Kokko had to build a market intelligence product to take on the incumbents. I was privileged to lead Engineering with Yuri Bushnev and Bhavesh Patel. In the last year learning from Joseph Rozenfeld how to shape a global engineering culture was a career highlight. The people I can't tag here far outnumber the ones I can. To the individuals and teams in engineering, product management, customer success, marketing and sales, spanning three continents and more than a half dozen countries — it was a privilege to build together. Thank you. 🙌 What's next? Reading Die With Zero and Tim Urban's blog post The Tail End heavily influenced my decisions over the past year. In the immediate term, before my kids are old enough to (hopefully 🤞) move out of the house, I want to maximize quality family time and explore wherever we are in the world. Beyond Italy this Fall our location is unknown. I'm considering options for what comes next professionally knowing, at least for now, it needs to accommodate a nomadic lifestyle. Maybe that will be consulting or fractional CTO work. Or maybe it is time to pursue a Founder role. Figuring that out is all part of the next adventure...
-
Ed Bellis liked thisEd Bellis liked thisAre you coming to Blackhat? You should be if you want to come to the Second Annual Rat Pack dinner. https://lnkd.in/g8ZJ9ctN
-
Ed Bellis liked thisEd Bellis liked thisCybersecurity used to be a niche subculture. Now it’s a national-risk conversation. What changed — and who told the story? On the new episode of The Security.com Podcast, Tony Welz, a 25+ year veteran of cyber PR, walks through the three eras of cybersecurity media — the wild-west early 2000s, the maturation of the mid-2010s, and today’s strategic era of SEC disclosure and kinetic war. If you’ve ever briefed a journalist, briefed a board, or watched cyber go from a tech beat to a business story — this one’s for you. Watch the full episode → Link in top comment W2 Communications Symantec Carbon Black #Cybersecurity #CyberPR #SecurityCommunications #CISO #ThreatIntelligence #Symantec
-
Ed Bellis reacted on thisEd Bellis reacted on thisMy wife Kathy just got nominated for a James Beard Award ‼️ For anyone outside the food world: the Beards are the Oscars of food. There is nothing bigger. Every cookbook published in the U.S. last year was eligible (thousands of them) and the Foundation just narrowed it down to three nominees per category. Kathy is one of them. House of Nanking: Family Recipes from San Francisco's Favorite Chinese Restaurant (co-authored with her dad, Peter Fang) is a finalist in the Professional and Restaurant category. It's the story of the restaurant her father built from nothing in 1988, the recipes that made it a SF institution, and the family that has kept it running for nearly 40 years. I've watched her work on this book for years. The late nights testing recipes. The conversations with her dad pulling out memories he hadn't shared in decades. The pressure of trying to do justice to a story that belongs to her whole family and to a city that adopted them. Watching the people you love chase something this hard, and then watching the world recognize it. There's nothing like it 🔥 Winners are announced June 13 at the Art Institute of Chicago. Whatever happens that night, she's already done the thing. So proud of you, Kathy Fang 🥇
-
Ed Bellis liked thisEd Bellis liked thisFollowing up on my previous post about key performance benchmarks from the 2026 State of Pentesting Report, I'd like to talk about high-risk vulnerabilities. 💡 BLUF: High risk-reducing performance is achievable even in a high-risk environment. The last post (link in comments) distinguished leading vs. lagging performers based on the time it takes them to resolve half of the high-risk findings uncovered in their penetration test. The first question that I had during the analysis - which was echoed by some comments to the post - is whether the "leaders" simply didn't have many high-risk findings to contend with. That might be because they eliminated them prior to the pentest, because the assets in scope weren't highly critical/sensitive, or any number of other reasons. Bottom line - maybe leaders just got a "head start" and so reached the halfway mark earlier. The analysis, depicted in this chart, proved that to not be the case. Like last time, each dot in the chart represents an organization. The axis measures the proportion of each org's pentest findings rated as high risk (more on this rating in a future post). Leaders are indicated in blue; laggards in pink. The fascinating thing is that leaders and laggards are dispersed throughout the range. This clearly disproves the hypothesis that the primary success factor of leading organizations is a low rate of high-risk findings. This is not just a "noteworthy analytical outcome" that excites data nerds like me. The takeaway is really important for teams struggling to keep up with the many security issues vying for remediation priority. It shows that high remediation performance is achievable even in a high-risk environment. Case in point - that rightmost organization facing a 60%+ rate of high-risk findings that nevertheless achieved leader status by quickly resolving those issues. Conversely, the chart warns that orgs with fewer risky exposures should not rest on their laurels. We'll continue with more leader-laggard swarms in the next posts!
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Patents
-
VULNERABILITY ASSESSMENT BASED ON MACHINE INFERENCE
Issued US 10,503,908 B1
See patentTechniques related to vulnerability assessment based on machine inference are disclosed. A vulnerability assessment server may receive, from a client device, a set of metadata corresponding to a program stored on the client device. Further, the vulnerability assessment server may extract a program name from the set of metadata. Still further, the vulnerability assessment server may determine one or more vulnerabilities of the program based on searching for the program name in one or more…
Techniques related to vulnerability assessment based on machine inference are disclosed. A vulnerability assessment server may receive, from a client device, a set of metadata corresponding to a program stored on the client device. Further, the vulnerability assessment server may extract a program name from the set of metadata. Still further, the vulnerability assessment server may determine one or more vulnerabilities of the program based on searching for the program name in one or more storage systems that maintain sets of vulnerability data.
-
Identifying vulnerabilities of computing assets based on breach data
Issued US 9,270,695
Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is…
Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is identified based on the breach data. In another technique, multiple vulnerabilities of a computing asset are determined. A risk score is generated for the computing asset based on the vulnerabilities. In another technique, multiple remediations associated with a risk score and multiple vulnerabilities are identified. The remediations are ordered based on the remediations that would reduce the risk score the most if those remediations were applied to remove the corresponding vulnerabilities.
Other inventors -
-
Ordered Computer Vulnerability Remediation Reporting
Issued US 8,984,643
Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is…
Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is identified based on the breach data. In another technique, multiple vulnerabilities of a computing asset are determined. A risk score is generated for the computing asset based on the vulnerabilities. In another technique, multiple remediations associated with a risk score and multiple vulnerabilities are identified. The remediations are ordered based on the remediations that would reduce the risk score the most if those remediations were applied to remove the corresponding vulnerabilities.
Other inventors -
-
Internet Breach Correlation
Issued US 8966639
Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is…
Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is identified based on the breach data. In another technique, multiple vulnerabilities of a computing asset are determined. A risk score is generated for the computing asset based on the vulnerabilities. In another technique, multiple remediations associated with a risk score and multiple vulnerabilities are identified. The remediations are ordered based on the remediations that would reduce the risk score the most if those remediations were applied to remove the corresponding vulnerabilities.
Other inventors -
Recommendations received
5 people have recommended Ed
Join now to viewOther similar profiles
Explore more posts
-
Roland Atoui
I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.
-
Dan Ricci
Good morning! Here is this week's ICS Advisory, Other CERT, and Vendor vulnerability advisories weekly summary for 23 - 27 February 2026. This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Copeland, InSAT, CloudCharge, EV Energy, Chargemap, SWITCH EV, Mobility46, EV2GO, Gardyn, Johnson Controls, Inc. Pelco, Inc. and Schneider Electric. One update was released this past week for Honeywell Schneider Electric, Mitsubishi Electric, Hitachi Energy, ICONICS and Mitsubishi Electric. Based on the new CISA advisory, #Energy, #TransportationSystems, #Commercial #Facilities, #Healthcare and #PublicHealth, #Defense #Industrial Base, #Food and #Agriculture, Critical #Manufacturing, #Government #Facilities, #Financial #Services, #InformationTechnology, #Water and #WastewaterSystem are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 16 new ICS Advisories for Festo, ARC Informatique, Moxa, Phoenix Contact, ABB, Bosch Rexroth, Hitachi Energy, Ubiquiti Networks, Trumpf, PDUexperts, Socomec and one update for Hitachi Energy. View the summary details of other CERT & Vendor product advisories identified last week (23 - 27 February 2026) at: https://lnkd.in/efKiMsxs This past week, CISA added 3 new Known Exploited Vulnerability (KEV) Catalog. None added this week correlated to a CISA ICS Advisory. ICS Advisory Project identified one CVE: CVE-2020-11023 – JQuery Cross-Site Scripting (XSS) Vulnerability listed in the Festo advisory for CODESYS vulnerabilities in Festo Automation Suite [VDE-2025-108]. This week, ICS Advisory Project, powered by Industrial Data Works LLC, in collaboration with EmberOT, released our 2024–2025 ICS/OT Vulnerability Intelligence Report. Check it out at: https://lnkd.in/ehG4DNPs Thank you all at EmberOT for your amazing support in getting this report out this year. Acknowledgement: Thank you Mikael Vingaard at the ICSRange for sharing with ICS[AP] the new ICS Advisory for PDUexperts. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides & Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week! #CISA #ot #ics #otsecurity #icssecurity #cybersecurity #cybersecurityawareness #industrialautomation #buildingautomation #oilandgas #maritime #vulnerabilitymanagement Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.
-
SlashID
New breakdown: NYDFS’s 2026 vishing advisory, mapped to identity detections and controls. The advisory describes a consistent pattern: attackers impersonate IT help desk staff, direct victims to a malicious link, capture credentials in real time, then prompt for the MFA code to immediately authenticate and obtain remote access. The sequence we see repeatedly: ↳ Password reset → new login from new geo/device within minutes ↳ New MFA device enrolled shortly after reset ↳ SSO session minted from a new IP / ASN, then immediate access to high-value apps ↳ Privilege escalation attempts after initial foothold The post also maps a concrete control to the help desk hinge point: Mutual TOTP verification, so resets and enrollments aren’t approved based on voice alone. Full breakdown → https://lnkd.in/gBv3e_Hk
-
Mark Thomasson
Insider risk resources are often scarce, and many large organizations, such as Google, tend to address these issues only after well-publicized incidents. -https://lnkd.in/gxyAny7a. Marshall Heilman and the folks from DTEX partnered with the Ponemon Institute to release the "Cost of Insider Risk 2026 Global Report" - https://ponemon.dtex.ai/. This report is the gold standard in providing trends to evaluate and budget for your own Insider Risk program. Share it with your chronically underappreciated Insider Risk folks Key Insights - Total average annual cost of insider security incidents is US$19.5M - Companies with an insider risk management program save themselves from 7 incidents a year, saving on average 8.2 million dollars - Time to Containment is reduced with a commitment to budgeting for Insider Risk, with an average of 67 DAYS to contain, down from 86 in 2023 - They address the rising COST OF SHADOW AI with cost of $10.3M due to negligent insiders
-
Jack Jones
I'd like to think that people would recognize an obvious point here. Safe, which relies on FAIR analytics, was miles ahead of even the other CRQ leaders in Forrester's analysis (and Safe isn't the only FAIR-based player in the market). If this doesn't blow a great big gaping hole in ridiculous claims that FAIR is somehow irrelevant in 2025, I don't know what will. Unfortunately, many of these claims about FAIR are driven by one of two things -- 1) ignorance, or 2) misinformation for competitive messaging. As far as ignorance goes, very often that's simply a mistaken belief that FAIR is dependent on SME estimates and/or relies solely on betaPERT distributions. Neither is true. If you have empirical data, FAIR can consume it. If you want to use a different distribution, FAIR's fine with that too. FAIR is a model, folks. It defines factors and their relationships -- period. As such, there are many ways to implement it, each with its strengths and weaknesses. Furthermore, FAIR describes how risk works, which doesn't change as the risk landscape changes. Yes, the details of the risk landscape (e.g., threats, assets, controls, etc.) change over time, but how RISK works (and therefore FAIR) is resilient to these changes. Think of this as being similar to Copernicus' observations of the solar system -- elliptical orbits, etc. Those observations describe how the solar system appears to behave. You may discover (or remove) planets but the nature of the system remains unchanged. I'm excited for my friends at Safe, who have worked very hard to get the product to where it is. But let's also recognize that CRQ is still largely thought of as a nice-to-have, and we're only going to overcome that by educating the market and raising risk measurement expectations, and not through misrepresentations.
11 Comments -
Daniel Young
Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?
1 Comment -
Pravesh Gaonjur
Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers
2 Comments -
MemeLord Robin Yong
Thanks to Ray Panta sharing below, National Institute of Standards and Technology (NIST) Special Publication is always a good reference for Cybersecurity practitioner in CyberSecurity related area. NIST SP as a whole is free, public accessible and by created by expert for everyone. What more else one can ask for such a good deal ? 😅 💻 Cyber risk means the chance of something going wrong in digital systems 🌐 – like hackers stealing data 🕵️♂️, systems going offline 🚫, or software getting hacked 🐞 🔐 It includes risks to privacy 🧾, finances 💸, business operations 🏢, and even national security 🛡️ 📘 NIST SP 800-30 is a guide 📖 from the US National Institute of Standards and Technology (NIST) 🇺🇸 that helps organisations figure out and manage their cyber risks ⚠️ 🧮 It teaches how to do risk assessments 🧠 – like identifying threats 👀, figuring out how likely they are 🎯, and what damage they could cause 💥 🧩 It's a key part of the NIST Cybersecurity Framework, used worldwide 🌍 to build safer digital systems 🏛️ NIST Special Publications are official guides 📚 that offer best practices, standards, and strategies for improving cybersecurity 👋 Robin Yong #MemeLord #LobinKor 🏆 #Favikon #CyberSecurity & #LinkedIn #Malaysia 💻 #5G, #ArtificialIntelligence, #IT, #CyberSecurity, #ForeignAffairs & #Geopolitics 🤝 https://v.gd/Robin ✨ #AI-augmented content, do fact check if in doubt ℹ️ #MemeLord not liable for the info shared.
1 Comment
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content