Dave Anderson

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

“Are we compliant?” is not the same question as “Are we secure?” Too many teams check every box on the compliance list… and leave the back door wide open. Compliance frameworks are baselines — minimum requirements, not maximum protections. They’re designed to raise the floor, not build your ceiling. The trap? Once the audit’s done, people relax. Old controls stay on paper but break in production. Exceptions pile up. Gaps widen. And attackers don’t care that you have a shiny certificate — they care about that one misconfiguration you forgot to fix. Use compliance as your floor, not your finish line. Keep testing, keep verifying, keep asking: Does this still make sense? Because the threat landscape won’t wait for your next audit cycle.

4

Anthropic is a lousy pusher. Their users are addicted, but they can’t get more supply. On a more serious note, this is why AI token unit economics matter. When you can’t afford to serve your best customers, it’s time to revisit your supply chain. NeuralMesh Augmented Memory Grid by WEKA, is literally here to help 100x.

12

2 Comments

Most teams think “our code is safe” because it’s in a private repo, behind VPNs and internal access controls. But that’s exactly where the danger hides. Code doesn’t need to be public to be compromised. All it takes is one exposed token, one leaked credential, or one compromised internal system and suddenly, your entire codebase becomes accessible. The recent Red Hat incident shows how a single GitLab compromise can give attackers access to secrets, database URIs, and sensitive application code. Once that happens, it’s not just source code theft, there could be a lot of downstream impact depending on other security controls you have in place. That’s why securing code from the inside out matters. Detect hardcoded secrets, misconfigurations, and vulnerabilities before they ever reach your repo or CI/CD. Because in today’s world, “internal” doesn’t mean “safe.” #ApplicationSecurity #ShiftLeft #CodeSecurityIntelligence #DevSecOps

11

More alerts ≠ more security. Our GitHub client triaged 847 vulnerability alerts last week. XOR's reachability analysis? 12 were actually exploitable. We auto-patched those 10. Silenced the noise. Security isn't about catching everything. It's about patching what matters. Most tools optimize for coverage. We optimize for signal. #cybersecurity #AIagents #startuplife

9

LOS DOSE – SOC 2 Quality Guild Edition I’m stoked that the quality of the SOC 2 is being questioned these days. It’s easy to say SOC 2 is dead or SOC 2 sucks or whatever. It’s much harder to do something about it. The SOC 2 Quality Guild is doing just that. If you are in the GRC and assurance space, pay attention to the work that Troy Fine, Henry Stanley, Dr. Omar Sangurima, CISSP, Val Dobrushkin, Chris Honda and MANY are doing. I know I've seen Danielle Kucera on the Slack channel! Jack Rumsey....#GRCDestroyer Because of the work of these folks, there is a new standard for SOC 2 quality and reliability that every GRC practitioner should engage and adopt at https://s2guild.org. Stay warm out there!

25

5 Comments

🦀 When Security Research Bots Go Rogue: The Trivy "OpenClaw" Incident Following the Moltbook chaos and the Stanford Artemis research I’ve been tracking, we just witnessed a new milestone in "agentic" security: 🚨 the breach of Trivy (and several other major projects) by the hackerbot-claw (OpenClaw) bot. The "Agent" Problem: What makes this fascinating (and terrifying) is that this wasn't necessarily a "hacker" in the traditional sense. It was an autonomous bot, likely designed for "security research", that got out of control (or was let loose). It scanned, verified, and executed at a speed no manual SOC could match. It identified a GitHub Actions vulnerability, exfiltrated secrets, and began automatically dismantling the repo. I want to give a shout-out to the team at Aqua Security / Trivy. As a former CISO, I’ve seen my fair share of incident responses, and their handling of this was top! Radical transparency is the only way to maintain trust in an era of automated attacks My Takeaway: We are officially in the era of Autonomous Supply Chain Exploitation. If you aren't auditing your GitHub Actions permissions (specifically pull_request_target triggers), you are leaving the door unlocked for the next "research bot" to walk in. What are you doing to monitor "agentic" activity in your CI/CD pipelines? Are we ready for bots that can exploit faster than we can patch? #CyberSecurity #CISO #Trivy #OpenClaw #AI #SupplyChainSecurity #PaloAltoNetworks #GitHubActions

58

6 Comments

Checkbox compliance is not an 'intent' problem, it's a maths problem. If someone is charging you $5K including an cheap and cheerful audit ($2K?) to get SOC2 Type 2 compliant, there just isn't enough budget to do it well. SOC2 Type 2 has >200 controls. Even after trimming and merging, close to 100. That $3K budget will get you maybe 20 hours of moderate quality vCISO time or 60 hours of inexperienced box checker time. Say you get the experienced vCISO. That leaves you 5 controls per hour. Not just getting you compliant, but in theory, setting you up for long term success. 12 minutes for vulnerability management. 12 minutes for access reviews. 12 minutes for user education. 12 minutes for identity and access management. 12 minutes for vendor risk assessments. 12 minutes for a tabletop exercise. And so on and so on and so on. Not just do the thing, but set you up to continue to do the things going forward. Because SOC2 isn't a destination. It is a continuous management framework that will be audited year after year after year. 12 minutes seem like enough to you? Would you be willing to sign your name to that sort of work? Why would you trust someone who is? Seals at sunset, Comox Marina, British Columbia

23

1 Comment

Sick SOC: A Practical Checklist of Symptoms! That SOC that looks operational (alerts, dashboards, tools) but lacks strategy, visibility, and repeatable response, so it quietly fails. Yeah… that’s called a sick SOC. I love the term “Sick SOC” — framed by Reza A. in his article, highlighting key metrics and warning signs that indicate your SOC isn’t operating at its best quality. • Strategic misalignment • Process & governance breakdown • Visibility & detection gaps • Knowledge & capability gaps vs threats • Architecture & technical implementation flaws • People & culture You can’t cure a sick SOC with more alerts; you cure it with clarity, coverage, and capability: https://lnkd.in/g9k63pfF If you want to make that checklist more “complete” and more usable in real SOC assessments, I’d add these categories: • Service management + customer alignment (SOC as a product) • Detection engineering lifecycle  • Data quality management (not just “data sources”) • Identity-centric operations (where modern incidents live) • Resilience + readiness • Third-party / supply-chain visibility I don't know what you heard about me! I practice, test, learn in public, and share what actually works ... daily and free! Threat hunting 101 series on YouTube: https://lnkd.in/g7D4pTVk Daily Cyber Drops on Medium: https://lnkd.in/gsekf7kB Nothing Cyber. Keep hunting. #cybersecurity #threathunting #threatdetection #opensource #tips #career #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #dataanalysis #incidentresponse #ai

31

2 Comments

OCR Director Defends HIPAA Updates: "There's a very high cost of doing nothing. A successful cyberattack can cost far more in terms of reputation, potentially paying a ransom, remediation of information systems, protection for those whose PHI was accessed, potential civil lawsuits from harm to individuals, and not to mention my investigators coming and knocking on your door and asking for information and talking about penalties." https://hubs.ly/Q04793ML0

1

Most teams are doing smart contract audits backward. What I see constantly: teams rush to write code, then scramble to book an external audit at the last minute, treating it like the TSA checkpoint before launch. That results in $50K+ audit bills packed with vulnerabilities that could've been caught during development. Weeks of delays. Sometimes, complete rewrites. The audit firm isn't the problem. The approach is. External audits should confirm your security work, not discover it. At Olympix, we've analyzed hundreds of smart contracts. The pattern is clear: teams with rigorous internal testing get through audits 3x faster, spend half as much, and launch with genuine confidence. Internal testing isn't sexy. It doesn't come with a badge you can put on your website. But it's where security actually happens: → Static analysis catches common vulnerabilities automatically → Unit tests verify every function under edge cases → Mutation testing ensures your tests actually work → Fuzzing explores scenarios you'd never think to test manually By the time you reach external auditors, they should be looking for subtle, novel vulnerabilities, not basic access control issues that a linter would flag. The math is simple: Option A: Ship code to auditors → Get hammered with findings → Rewrite → Audit again → Finally launch (8-12 weeks) Option B: Test rigorously internally → External audit validates → Launch (4-6 weeks) The DeFi space has lost billions to exploits. Many of those protocols were audited. The audit wasn't the problem. The lack of internal testing foundation was. Security isn't a checkpoint. It's a discipline that starts on day one of development. What's your team's internal testing process before external audits? Curious to hear what's working for others.

9

The breach didn’t happen because of zero-day malware. It didn’t happen because of a nation-state actor. It happened because someone still had access — and they shouldn’t have. Former employees. Expired contractors. Shared admin accounts because “it’s easier.” This is why access control is the first domain in NIST 800-171 — not because it’s simple, but because everything else depends on it. If you get access control wrong, no amount of logging, monitoring, or incident response will save you. Fix access control before it becomes your breach story.

15