Joe Goldberg

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

For those of you navigating CRA & RED-DA compliance… this one’s worth a read. For many years product security compliance was treated like a checklist exercise something to rush through right before launch. CRA and RED-DA changed that. Today, compliance isn’t optional, and treating it as a one-off task is a recipe for delays, lost trust, and missed opportunities. My colleague David Nosibor shares how the PSCOPE Maturity Framework can flip the script turning regulatory compliance into a continuous operational capability that drives performance, scalability, and trust. Instead of chasing PDFs and scrambling for evidence, PSCOPE builds shared language, measurement, and maturity across governance, automation, supply chain, and monitoring. I strongly believe that this is exactly the kind of shift our ecosystem needs. https://lnkd.in/eBudy-wk #CyberSecurity #CRA #RED #Compliance #ProductSecurity #PSCOPE #ContinuousCompliance #CyberResilience #IoT #Regulations #CyberPass

20

1 Comment

Manual, alert-by-alert triage is reaching its breaking point. This week, we're introducing Corelight Agentic Triage, a new capability within Corelight Investigator designed to move SOC workflows beyond isolated alerts and toward entity-centric investigations. Instead of reviewing hundreds of alerts, analysts receive prioritized entities with pre-correlated evidence and behavioral context already assembled. Read the launch blog: 👉 https://lnkd.in/gGjUR7Hb #Cybersecurity #NetworkSecurity #NDR #SOC

24

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

Check out Janet Costello Worthington's blog on this often overlooked, but extremely important requirement to understand what exactly you have just placed within your Enterprise.

6

1 Comment

Most “compliance” programs still run on a point-in-time artifact: a PDF that’s stale the minute it’s signed. That model is now a strategic liability: • Threats move at machine speed—Salt Typhoon operated undetected for 1,247 days. Your annual PDF missed all of them. • Cost and calendar drag turn security into a gating function ($1–3M, 12–18 months for FedRAMP). • Evidence isn’t verifiable—it’s software-reported. FedRAMP 20x is the signal: shift to machine-readable evidence and automation-first validation. The next step is bigger: compliance becomes an infrastructure property—continuous, cryptographic, real-time. I unpack what this looks like (and what to prioritize next) in the full analysis here - https://lnkd.in/eH678Naq

2

Using Apple’s iOS 26 Text Screening To Prevent Scams Phishing attacks delivered through SMS and iMessage (“smishing”) has become one of the most common digital fraud vectors because text messages are opened quickly and feel personal. Apple’s iOS 26 text screening helps safeguard consumers from smishing by reducing exposure, interrupting urgency-based manipulation and limiting risky interactions. Rather than expecting users to constantly identify deception, Apple’s design acknowledges human cognitive limits and embeds scam resistance directly into everyday communication workflows. iOS 26 text screening supports users who are statistically more vulnerable to scams, including older adults, non-technical users, and individuals under stress or time pressure. Research consistently shows that scam susceptibility is driven less by intelligence and more by situational factors such as distraction and emotional manipulation. By automating risk detection and restructuring how messages are presented, iOS shifts the burden of security away from individual vigilance and toward systemic prevention. iOS 26 text screening feature intervenes at the point of exposure, reducing both the likelihood that consumers engage with scam messages and the cognitive burden required to identify them. At the system level, iOS separates messages from unknown senders into several folders, including “Unknown Senders” and “Spam” folders. Texts diverted to the “Unknown Senders” and “Spam” folders do not trigger message notifications on your iPhone. This system design disrupts one of the core risks of smishing: IMMEDIACY. Scam texts are designed to appear alongside your trusted conversations with known contacts to trigger rapid, emotional responses like fear and urgency in a fake bank fraud text. By removing unfamiliar numbers from the primary message list, iOS 26 introduces friction and encourages more deliberate evaluation before a user interacts with the message. More advanced protection is provided through on-device message filtering and spam detection. iOS uses machine-learning models to identify patterns commonly associated with scam messages, such as suspicious URLs, coercive language, impersonation of institutions, and unusual sender behavior. Messages identified as potential junk are automatically filtered, reducing exposure before the user must make any judgment at all. iOS also limits the functionality available to suspicious messages by disabling any links. Unknown or filtered texts are less likely to enable rich previews, embedded actions, or seamless link interactions. This matters because smishing succeeds by minimizing effort—one tap on a link or reply can be enough to compromise personal data. By constraining these affordances, iOS reduces the chance of impulsive engagement, particularly on small screens where users cannot easily inspect URLs or sender details. Text screening has significantly reduced my scam text messages - none in the last 72 hours.

12

1 Comment

Hot take: Most "continuous compliance monitoring" isn't continuous. It's just frequent batch processing in disguise. Automating evidence collection quarterly ≠ audit-ready. Generating reports weekly ≠ real-time visibility. Conducting "control assessments" ≠ continuous assurance. Real continuous compliance means: Event-driven detection, not just scheduled scans Instant remediation alerts, not weekly reports Autonomous evidence collection, not "click here to export" I've seen companies celebrate reducing audit prep from 6 months to 3 months. That's not innovation. That's incremental improvement on a fundamentally broken process. The uncomfortable truth? If you're still "preparing" for audits, you're already behind. True Agentic AI for GRC means: → You're always audit-ready → Controls are always monitored → Drift is detected in seconds, not weeks → Evidence exists before auditors ask The companies still doing compliance "prep" will be the same ones doing security "assessments" while getting breached in real-time. Compliance isn't a project. It's a state. And AI agents will become the standard for maintaining that state continuously. Who else is tired of "audit season"?

37

3 Comments

Exploitation timelines are increasingly measured in days rather than weeks. Our latest report from Rapid7 Labs correlates vulnerability publication data, confirmed exploitation trends, frontline MDR incident response telemetry, and dark web, cybercrime, and nation-state intelligence to provide a unified view of how exposure evolves into compromise. One of the biggest standouts: how rapidly AI is being integrated into attacker playbooks, accelerating the operationalization of exposure. Many of the incidents we investigate still originate from known, unaddressed exposure. In those cases, attackers don’t need sophistication - they need opportunity. As remediation windows shrink, reducing that opportunity becomes essential to limiting compromise. You can download the 2026 Global Threat Landscape report here: https://r-7.co/4bQOAtq #infosec #cybersecurity

37

1 Comment

Yesterday, the OWASP GenAI Security Project released it's Top 10 for Agentic Applications, a focused list of the most severe security risks facing these self-governing systems. In a new blog post, Legit product manager Avishag Yulevich shares her perspectives on the new Top 10 and the relevance to AI coding agents. The blog also details additional risks to AI coding agents that Legit sees such as: * Generating vulnerable code * Sensitive data exposed by MCP extensions * Code exposed to 3rd parties * Hallucinated library injection Learn more in the blog - link is in the comments below. #AI #AIdevelopment #agenticapplications #OWASPTop10

5

1 Comment

Compromise usually starts quietly in someone else's environment long before any impact is visible internally. Despite this reality, many Third-Party Risk Management (TPRM) programs remain stuck in a compliance-first mindset. Relying on static vendor lists and annual questionnaires creates the appearance of control but fails to address active threats. The real challenge is not vendor volume but the lack of intelligence connecting vendor risk to real-world attacker behavior. Effective defense requires a shift to Risk-Aware Prioritization. By combining ecosystem relevance with real-time threat signals from Dark Web marketplaces and hacker forums, security teams can identify high-risk vendors before a breach spreads. This approach moves TPRM from a documentation exercise to an operational security function that detects exposure weeks before public disclosure. Read more: https://lnkd.in/gesYx5jH #TPRM #SupplyChainSecurity #CyberSecurity #VendorRisk #SOCRadar

5

I have seen firms depend heavily on vendor promises without ever asking for proof. That’s a dangerous degree of trust. Regulators expect written documentation and monitored compliance. At itSynergy, we help RIAs enforce the 72-hour notification requirement. #VendorRisk #RegSP #RIACompliance

3