Jerry Gamblin

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

🚨 Just released: Corero’s 2025 Threat Intelligence Report 🚨 DDoS atacks are no longer just big floods.They're frequency, evasion, and protocol pivoting. Key insights: • 11 attacks/day avg. in 2024 • Mid-size attacks declining • Multi-vector attacks on the rise Read the release: https://bit.ly/44kLkn0

15

Why your IR team should be running exercises with your red team monthly, not annually Most organizations treat incident response exercises like compliance events. Check the box once a year, update the deck, and move on. That approach might satisfy auditors, but it does almost nothing to prepare teams for a real incident. Annual exercises test memory. Monthly exercises build muscle. Real incidents are chaotic, emotional, and brutally time compressed. People are tired. Information is incomplete. Systems behave in ways no one expects. Under those conditions, no one is recalling what they read in a tabletop nine months ago. They are defaulting to habit, instinct, and whatever they practiced most recently. Running red and blue team exercises once a year assumes that incident response is a knowledge problem. It is not. It is a coordination problem. It is about how quickly people can share signal, make decisions with partial information, and act without waiting for perfect clarity. Those skills decay fast if they are not exercised regularly. Monthly collaboration between red teams and IR teams exposes the real issues early. Not the theoretical ones. The awkward handoffs. The alerts no one trusts. The escalation paths that look fine on paper but fall apart at 2 a.m. The tools that technically work but are too slow or confusing to use under pressure. Finding those problems during an exercise costs hours. Finding them during a live incident costs reputations. There is also a human factor most organizations underestimate. Trust. When red and blue teams only meet during formal annual events, the interaction feels adversarial and performative. When they work together regularly, it becomes practical and honest. The red team stops trying to “win.” The IR team stops being defensive. Both sides start focusing on improving outcomes instead of protecting ego. That trust pays off when it matters. During a real incident, teams that have trained together communicate faster, escalate earlier, and argue less. They know how each other thinks. They know where assumptions tend to break. They know when to push and when to step back. The uncomfortable truth is this: you do not rise to the occasion in an incident. You fall to the level of your training. If that training happens once a year, your response will reflect that. If it happens monthly, under realistic pressure, with people who challenge you constructively, your organization will be measurably harder to break. If you’re serious about incident response, treat it like a capability, not a calendar event.

7

2025 reality check: The average enterprise now runs 60–130 security tools. That translates to: • $3.5M+ wasted annually on overlap & shelfware   • 1,200+ alerts per day → 45-day average dwell time   • 75% of SOC analysts reporting burnout Tool sprawl isn’t just annoying — it’s the #1 preventable risk most companies still ignore. Check out Episode 27 of the DTF Cyber Podcast with a no-BS blueprint that actually works: → Inventory → Kill redundancies → Consolidate → Automate → Measure Real teams using this cut their stack 60-70% and slashed dwell time by 80%. If you’re a CISO, SecOps lead, or just tired of alert fatigue — save this post. #CyberSecurity #ToolSprawl #SOC #SecurityOperations #CISO #BlueTeam

57

2 Comments

Cybercriminals often bypass technical defenses by targeting employees through sophisticated social engineering attacks and phishing scams. A robust security strategy must include ongoing employee training and attack simulations to build a human firewall.

1

According to SentinelOne’s 50+ Cloud Security Statistics for 2025: - 45% of data breaches now happen in the cloud - 68% of organizations cite cloud account takeovers as one of their biggest risks - More than 80% of breaches involve compromised credentials, misconfigurations, or insider misuse At Permiso, we’ve reported extensively on how threat actors are exploiting these gaps—using valid human and non-human credentials to move laterally, escalate privileges, and operate undetected across cloud, SaaS, and IAM environments. What’s being missed: - Role assumptions across accounts - Privilege escalations in SaaS platforms - Abuse of service accounts and automation tokens - Lateral movement across federated and cloud-native identities Identity has become the most targeted and least monitored layer of the modern enterprise. And attackers know it. If you’re thinking about how to strengthen visibility and detection across your identity surface, take a look at the Permiso platform. It’s built to provide real-time insight into identity behavior across all environments—cloud, SaaS, and CI/CD—for both human and non-human identities. 👉 https://lnkd.in/g7iRM47M Feel free to DM me if you’d like a demo or a private threat briefing on what we’ve been seeing.

5

Every acquisition multiplies tabs. Tabs multiply risk. Start at the session. M&A adds new portals, vendors, and logins overnight. Most of it lands in the browser, not behind your firewall. If sessions are blind, attackers get a free path. Secure the session where credentials, files, and prompts move. Visual credit: Nimble #Cybersecurity

28

4 Comments

Sick SOC: A Practical Checklist of Symptoms! That SOC that looks operational (alerts, dashboards, tools) but lacks strategy, visibility, and repeatable response, so it quietly fails. Yeah… that’s called a sick SOC. I love the term “Sick SOC” — framed by Reza A. in his article, highlighting key metrics and warning signs that indicate your SOC isn’t operating at its best quality. • Strategic misalignment • Process & governance breakdown • Visibility & detection gaps • Knowledge & capability gaps vs threats • Architecture & technical implementation flaws • People & culture You can’t cure a sick SOC with more alerts; you cure it with clarity, coverage, and capability: https://lnkd.in/g9k63pfF If you want to make that checklist more “complete” and more usable in real SOC assessments, I’d add these categories: • Service management + customer alignment (SOC as a product) • Detection engineering lifecycle  • Data quality management (not just “data sources”) • Identity-centric operations (where modern incidents live) • Resilience + readiness • Third-party / supply-chain visibility I don't know what you heard about me! I practice, test, learn in public, and share what actually works ... daily and free! Threat hunting 101 series on YouTube: https://lnkd.in/g7D4pTVk Daily Cyber Drops on Medium: https://lnkd.in/gsekf7kB Nothing Cyber. Keep hunting. #cybersecurity #threathunting #threatdetection #opensource #tips #career #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #dataanalysis #incidentresponse #ai

31

2 Comments