About
I bring your cybersecurity and threat exposure into the light, so you can gain the needed support from the board, management, regulators and others to fund needed protections.
Like a capable physician, I first understand where it hurts, how long this has been happening, and things you've tried yourself. Then, you'll hear me say "let's run some tests". NIST. MITRE ATT&CK. Benchmarking against others in your industry. Applying actual event patterns and probabilities. And insurance-grade analysis. This allows us to answer the three key questions:
1.) How much cybersecurity risk do I actually have?
2.) Where is most of it coming from (root causes)?
3.) What is it costing me?
Once we know, we can sit down and craft the next steps to get things to a better place. No nonsense. Data-driven. Objective. Regulator-approved.
Many clients ask: "I know we're spending more on cybersecurity, but what are we actually getting?". This analysis is essential to not only cyber, but any properly-run function in the business. Cybersecurity is not a mystery-land that somehow is the one and only function of the entire enterprise that just can't be measured, cant't be quantified, and can't be transparent. Let me bring you the answers, and get on a better track to improvement and protection now.
A four-year US Air Force veteran with Secret clearance, David is an expert information security and executive-level technology professional with a 20+ year portfolio of some of the most ground-breaking and high-value project results in information security, technology, privacy, asset management, IT risk management and infrastructure.
For more than a decade he has been privileged to serve and consult to some of the world's most respected organizations in the United States, Latin America, and Europe. His writing includes examining the measurable value of technology-based capability and its role in risk mitigation in the 2011 book “Webify” (https://www.amazon.com/Webify-Interconnections-Strategy-Capability-Volatility-ebook/dp/B006RX4PXM). He has served on the board of a public investment trust and as a member of the senior executive committee of a $5bn Nasdaq company.
Services
Articles by R David
-
How the largest cyber loss in US history was forecast - ten months earlier
How the largest cyber loss in US history was forecast - ten months earlier
On February 21, 2024, Change Healthcare discovered it had been the victim of what has now gone on to be the most costly…
1 Comment -
Do we really know risk?
Do we really know risk?
What is our understanding of risk? Is it sufficient to properly form a basis for action - the kind of actions that will…
1 Comment -
What is the First Principle of Cybersecurity?
What is the First Principle of Cybersecurity?
In a recent conversation with Rick Howard, Chief Advisor to The Cyberwire, Cybersecurity author and distinguished…
-
Risk? What Risk?
Risk? What Risk?
What have we learned from the parade of major cyberattacks in recent days? In the complex world of cybersecurity, it's…
1 Comment -
Data-Driven Risk Preparedness Now
Data-Driven Risk Preparedness Now
It's the one major job to be done by every manager and executive. Risk.
-
What do the SEC, ABA, NACD and EU GDPR Authorities all agree you need to do now about Cybersecurity Risk?
What do the SEC, ABA, NACD and EU GDPR Authorities all agree you need to do now about Cybersecurity Risk?
Cyber risk - Warren Buffett says it’s the number one threat in our world. In your business it’s crucial - the risk is…
-
What Warren Buffett sees as the number one problem today - and how to understand it.
What Warren Buffett sees as the number one problem today - and how to understand it.
"I don't know that much about cyber, but I do think that's the number one problem with mankind.” - Warren Buffett, May…
-
Taxonomy of a Cyber Incident Response
Taxonomy of a Cyber Incident Response
New York Times reporters Eric Lipton, David Sanger and Scott Shane just broke a story this evening chronicling a sad…
1 Comment -
Join Arx Nimbus on Wednesday in Cambridge for Aspen Institute's Cybersecurity Summit at MIT
Join Arx Nimbus on Wednesday in Cambridge for Aspen Institute's Cybersecurity Summit at MIT
Arx Nimbus will be in attendance for Aspen Institute's and CNBC's Cyber Summit. Assembling top leaders in business…
-
Arx Nimbus partner Intellispyre selected as Cisco Digital Disruptor semifinalist in Cybersecurity category
Arx Nimbus partner Intellispyre selected as Cisco Digital Disruptor semifinalist in Cybersecurity category
Congratulations to Paulo Shakarian and his team for their selection by Cisco Systems as semifinalist in the Innovation…
Activity
12K followers
-
R David Moon, CISSP shared thisWomen Pioneers of Computing Tricia this is a great post. In my own experience, I had the opportunity to meet and speak on-on-one with Adm. Grace Murray Hopper early in my career. Adm. Hopper was presenting at one of our ACM (Association for Computing Machinery) events, and as I recall it was quite a line that formed to meet her after her talk. But having started my career in computing in the military myself, I was well aware of her many contributions to our profession. She gave me a roughly two-foot piece of wire from an old "Eniac" computer. She explained that "this is a nanosecond". I said "But a nanosecond is a unit of time", and she explained that the length of the wire she gifted me was the distance that represents how far electrons can travel at the speed of light. I treasure that interchange to this day, and regard her as one of the most inpiring leaders to me in my career.R David Moon, CISSP shared thisCybersecurity didn’t start with a SOC, a SIEM, or a compliance framework. It started with people who fundamentally changed how computers—and information—work. Women have been at the center of that story from the very beginning. From the mathematical imagination of Ada Lovelace… to the programming revolution led by Grace Hopper (The Grace Hopper Program at Fullstack Academy)… to cryptography breakthroughs by Joan Clarke… to modern leaders shaping today’s cyber policy and infrastructure, like Jen Easterly and Susan Landau. Innovation in cybersecurity isn’t a trend. It’s a lineage. And that lineage includes scientists like Valerie Thomas, emerging investors and builders like Chenxi Wang, Ph.D., and rising voices inspiring the next generation like Eva Benn. The point isn’t to celebrate women in cyber for one month. It’s to recognize that the foundations of this industry were built by people whose work still shapes how we defend digital systems today. Women’s History Month is just a good reminder. 👇 Who are the women—past or present—who shaped your view of cybersecurity? R David Moon, CISSP Andrew Patterson Mohammed Junaid Shaik John Cavanaugh Bob Zukis Rick Howard J. Carlos Vega, CISSP Gustavo Rodriguez MA, MPA Dr. Georgianna (George) S. Weiyee IN [殷 維一] Zach S. Gary Pica Paulo Shakarian George Wang PMP Pat Gannon Bernie Fleitman Ron McNair Falcon Risk Services HDI Group Women in CyberSecurity (WiCyS) Women Who Code Women of Influence+ #WomensHistoryMonth #CyberSecurity #WomenInCyber #TechHistory
-
R David Moon, CISSP shared thisCMMC Readiness Now I'm pleased to share that our friend Jerry Leishman, CEO of CMMC Advisors, is inviting DoD Prime and Subcontractor executives and leaders to attend the CS5 Executive Leadership Summit on April 15 in San Diego. With CMMC enforcement advancing under the United States Department of War and other Federal agencies, this is the need-to-attend conference for all DoW suppliers working their way through CMMC and-or maintaining their compliance. https://lnkd.in/gbCYRjVE https://cs5west.org/ - DavidHome - CS5 West | The Official Conference of The Cyber ABHome - CS5 West | The Official Conference of The Cyber AB
-
R David Moon, CISSP shared thisWhat is "Avoidance Coping", and what is its role in Enterprise Security? In our work with top executives, industry advisors, CISOs, board directors and others, one lurking "shadow factor" shows up all too often: Avoidance Coping ("AC"). AC is a well-known behavioral pattern. The American Psychological Association provides an assessment instrument to determine the presence of AC: https://lnkd.in/gGcncx-T. In securing the enterprise, AC-influenced decision making is important to understand since the consequences can de catastrophic - and very costly to shareholders and others. Imagine two people walking down a road. One spots a massive truck coming directly at them both. The first person taps the other one on the shoulder and warns them, only to have the other person respond by questioning the exact speed of the truck, whether they can be sure it really is coming straight at them, etc. The rational response of course is to simply step off the road - but this is what happens when AC gets in the way. In our experience, getting AC out of cybersecurity requires six key steps - primarily around leadership becoming aware and accepting of fundamentals around cybersecurity exposure - listed here as "Cybersecurity Non-Avoidance". In consideration of the severe exposure of EBITDA to cybersecurity losses, Non-Avoidance is often the first step to a better place. AC can bring false comfort for a brief period, ending when the incident inevitably strikes. #ACRQ #arxnimbus
-
R David Moon, CISSP shared thisEvery organization needs strong offense and defense to thrive. Neither one will truly make up for the absence of the other. Offense: - Sales - Marketing - Recruiting - New product development - AI innovations - Geographic expansion - Acquisitions - Process Improvement Defense: - Legal - Insurance - Customer support - Compliance - Cybersecurity - Preventive maintenance In football, Offense gains yardage. Defense limits the loss of yardage. Coaches and statisticians study the results of players, formations, training, conditioning, play structure and player profiles to forecast expected outcomes. In business, it's not about yardage - it's about earnings. EBITDA. Every day, on all fronts, the organization is gaining through offense. And working to limit loss using proper defense. Think of a company like a football team, and its earnings like the result of the season. Every month is like another game in the season - and it will yield a score. You don’t know the final score yet — but you know: - Who you’re playing - Your form - Whether key players are injured - How tight the playoff race is Forecasting financial exposure is asking: “If we win, tie, or lose this game, how much does it change our season?” Cybersecurity is a key factor - an "X" factor, in the EBITDA results of the organization. Major breaches happen randomly - seemingly without warning, and can wipe out major slices of earnings. How much could we stand to lose? How severe could a loss be - within reason? And what factors can we control defensively, to lessen the blow and reduce the probabilities? Forecasting earnings exposure is like figuring out whether the next quarter is just another game or a must-win - before kickoff. Like an experienced coach, top cybersecurity leaders study these factors for answers - and apply them. EBITDA matters, and it's what we defend. But do we understand how the strategies we have at our disposal can affect the outcome? Do we know which moves will support the expansion of EBITDA, and which would leave it exposed to loss? Time to gain this understanding, evaluate the options with the proper NIST-centric business-literate tools, and deploy the sophisticated strategies needed for 2026. #arxnimbus
-
R David Moon, CISSP shared thisIsn't Cybersecurity only a cost center? Does it really have business relevance, other than simply providing regulatory compliance? This is a question that for ages, management has struggled to address. As a C-suite officer in the Fortune 500 myself, we always sought to avoid adverse events and certainly anything that might require formal reporting of an incident to SEC or other regulators. But in today's world, more leaders are recognizing the key role Cybersecurity protection, including proper protection of AI efforts, can play in enhancing financial performance. Profit, or EBITDA, is the key factor that keeps operations vibrant, funds new growth, and gains the support of shareholders not to mention expanding enterprise value. And yet it turns out in the real world that EBITDA is subject to disruption from system outages, unanticipated charges (e.g. Ransomware), and the kind of one-time charges against earnings that accompany every significant cybersecurity incident. So informed leaders are now asking - " What's the value of circumventing, preventing and reducing these outcomes?" Working with a data set of over 4,000 companies over several years, analysis of actual losses and financial impacts in correlation with specific cybersecurity controls and vulnerabilities, shows that measurable, material advances in assuring strong earnings is an attainable outcome from applying business-relevant metrics to the cybersecurity program. But what is the ROI available? In actual real-world organizations using this process, documented and audited outcomes include in excess of 12% improvements to EBITDA year-on-year, net of all additional investments. Understanding actual exposure is the starting point. Here in 2026, many have made very sophisticated efforts to put in place the most effective cybersecurity measures, and augmented those efforts with cyber insurance. And yet, residual risk remains. It's this risk that presents the real threat to EBITDA. As cybersecurity professionals, management and shareholders care little about how we've configured anti-exfiltration measures, how effective our endpoint behavioral analytics are, or how many new CVEs we've identified last month. That's for us as technologists to manage. Instead, they care far more about the core outcomes of the business - and EBITDA foremast among those. Now and going forward, simply securing the technology is still very necessary, yet no longer sufficient. It's time to also secure the business and get the results that actually move the needle in safeguarding what's most important - starting with EBITDA. Find out what others are accomplishing, and how boosting EBITDA takes cybersecurity beyond simplistic cost-senter mentality and into full participation in the business. #arxnimbus
-
R David Moon, CISSP shared thisIt's 2026 - time to get serious about thorough, business-relevant visibility across the entire exposure the enterprise is presenting to attackers. Especially the often-underplayed exposure from AI. Join us and our partners at ProCap to finally get the complete picture and be ready for 2026!R David Moon, CISSP shared thisAs of 2025, over 426 AI related policies have been adopted globally, with another 401 under discussion. Organizations must navigate a matrix of jurisdictional laws and technical standards. Nearly 48% of Fortune 100 boards now explicitly list AI risk as a core oversight responsibility—a 3x increase since 2024. Failing to provide transparency (via AIBOMs) can lead to penalties under the EU AI Act similar to GDPR (up to 7% of global turnover). Biased outputs or "runaway" agentic processes can cause immediate market capitalization loss. AIBOMs serve as "financial insurance" by proving due diligence and source authenticity. 36% of public companies now cite AI as a separate material risk factor in their 10-K filings. Let's work together to address 1) Continuous Monitoring: Unlike traditional software, AI models "drift." AIBOMs must be integrated into Continuous Authorization to Operate (cATO) pipelines to ensure the model running today is the one that was validated. 2) Agentic Risk: 60% of organizations are deploying "agentic AI" (autonomous agents), but over half have not assessed the risk of autonomous decisions conflicting with business goals. 3) Supply Chain Resilience: AIBOMs provide a "failure plan" by documenting alternative models and infrastructure if a primary provider (like Hugging Face or an API) faces an outage or compromise. https://lnkd.in/gBVWMhzV #SBOM #AIBOM #ProCap360 #AI #BusinessExposure #Cybersecurity #ArxNimbus #CISO #BISO #AgenticAINavigating AI Regulation A Strategic Guide for CEOs and BoardsNavigating AI Regulation A Strategic Guide for CEOs and Boards
-
R David Moon, CISSP shared thisIs your organization's EBITDA exposed to cybersecurity risk? It's unavoidable. Ask Ron McNair, board director of ArxNimbus. While Chief Accounting Officer of Sony Pictures, Ron booked the $400mm charge against EBITDA as a result of Sony's 2014 breach. The recovery costs, notification expense, fines, and - as Ron likes to say "How would you like the cost of running a major motion picture studio on pencils and paper for 18 months?" Each business will have its own costs post-breach. These costs are a direct product of exposure to cybersecurity impacts. Much like a warehouse facility in South Florida that is exposed to hurricane recovery costs, these cybersecurity costs fall into a certain range, and a certain probability. Determining the exposure you actually have is called Actuarial Science. In the case of cybersecurity exposure, actuarial science applied within standardized NIST controls yield a proper picture of actual economic exposure. Knowing where the enterprise stands in the exposure of its EBITDA to adverse cybersecurity costs is vital to the conduct and sustainability of business process in 2026 and forward. Responsible management teams evaluate these exposures in the case of property loss, accidental damage, supply chain disruptions and operational mishaps, yet even today there are those who have not gained the same level of financial understanding on this critical area of cybersecurity exposure as they already have on the other vital areas of exposure for the firm. It's been said that getting to a better place begins with knowing. EBITDA is important. In many ways, it is the reason for the organization's very existence. How will you reduce the exposure your EBITDA currently carries and get greater assurance around the ability to continue to defend and deliver these all-vital EBITDA results? Make it your plan and commitment in the ever-greater-digitally-exposed world of 2026 to get proper insights in place, gain the visibility to cybersecurity exposure, and calibrate the appropriate fixes to the nature of the challenge. #arxnimbus #triciasacchetti #ACRQ #CTEM #NIST #actuarialscience #johncavanaugh #thrivacaR David Moon, CISSP shared thisBefore the year ends, it's clear there’s one question worth answering...
-
R David Moon, CISSP shared thisSelf-satisfaction is a lovely state - until it ends, like it always does. Have you been living in a state of self-satisfaction? The latest data is showing that not only are we failing to gain ground against cyber threats, we're actually losing the battle. But why? Don't we have the most sophisticated solutions ever in cyber? Aren't we relentless in hunting down vulnerabilities and neutralizing them? Perhaps. But as the trends show, that's no longer enough. Simply doing the same things in the same way in cybersecurity, over and over, is just not cutting it anymore. It's time for a change - time to start getting serious about managing cybersecurity like other parts of the business. Time to up your game and get real measurement of where you are, what our exposure is costing us, and what we gain back by the best and most attractive of all the available strategies. Time to get real.R David Moon, CISSP shared this#WednesdayWisdom from #Arximedes: The illusion of security thrives on comfort zones: same tools, same reports, same blind spots. When you’re ready to see what measurable resilience looks like (not just theoretical), ArxNimbus turns illusion into intelligence. Audit-Ready Metrics: Show the board the real cost of cyber risk. Actionable Insights & Observability Beyond the SIEM: Pinpoint exposures and prioritize investments. Co-developed with: US Strategic Command | MITRE Corporation | University of Chicago Trusted by: Government agencies, cyber insurers, Fortune 500 enterprises 👀 See it in action: https://lnkd.in/ecUkh5y4
-
R David Moon, CISSP shared thisAre unfunded liabilities still liabilities? Even if they don't appear on a balance sheet? The answer of course is yes. Active management, risk-aware management, requires the seeking-out of the major risks (like cyber) that impinge on the organization. But why? It's all because unfunded liabilities, like cybersecurity exposure (which is never zero, BTW), will ultimately become charges against earnings. Not necessarily right now, but they will. Much like a flood wiping out your home, the event has major economic consequences. It's comforting and appealing to ignore these consequences until they happen. But - this makes the impact all that much more extreme when the incident ultimately happens. Avoid surprise. Understand your exposure. Make proper preparations. #arxnimbusR David Moon, CISSP shared thisIt’s that time for #WednesdayWisdom from #Arximedes: Boards and exec teams love to say “Cyber is a top priority.” But if resilience is only measured in PowerPoints and checkboxes, then let’s be honest—it’s just theater. True resilience starts when the C-suite demands a modern approach: 👉 CFOs demand quantifiable financial risk. 👉 CISOs deliver actuarial-grade models, not static spreadsheets. 👉 CEOs/Boards tie cyber directly to business outcomes. At ArxNimbus, we built Thrivaca to turn cyber risk into financial intelligence. And we'll gladly show you where we get the data! HINT: It's not magic, it's math! Let's turn defending budgets into defending the business. 👀 Seeing the ROI is believing. Talk to R David Moon, CISSP & Andrew Patterson #CyberWakeUpCall #CFO #CyberROI #ACRQ #ArxNimbus
-
R David Moon, CISSP liked thisR David Moon, CISSP liked thisYour maintenance budget is bleeding and your calendar is to blame. Most industrial businesses still replace parts on a fixed schedule. Not because the part is worn out. Because the calendar says so. Meanwhile, the compressor that was quietly failing for 6 weeks just took down your production line on a Friday afternoon. We wrote about this problem and more importantly, the solution in our latest article. Here's what we cover: → Why reactive MRO management is a hidden profit leak (and the data that proves it) → How AI + IoT sensors can predict equipment failures 2–6 weeks before they happen → 3 real-world use cases from manufacturing, chemical processing, and food & beverage → The Microsoft tech stack (Power BI, Power Apps, Azure ML, ML.NET) that makes this possible → The 3 questions every CEO should be asking their operations team right now One stat that'll make you think: Companies using condition-based predictive maintenance report up to 50% fewer unplanned production stoppages. Not a future promise. Companies are doing this today. If you run an asset-heavy business and your maintenance strategy still looks like a spreadsheet and a gut feeling this article is for you. Drop a comment or DM us. Happy to walk you through what this looks like for your industry. #PredictiveAnalytics #SupplyChainMRO #ArtificialIntelligence #DigitalTransformation #ManufacturingExcellence #PowerBI #PowerApps #AzureML #MicrosoftAzure #IndustrialAI #MROManagement #PredictiveMaintenance #OperationalExcellence #CEO #CXO #CIO #AnsiByteCode #MicrosoftPartner #MLdotNET #SmartManufacturingFrom Reactive to Predictive: How AI Is Finally Slashing MRO Costs in Supply ChainsFrom Reactive to Predictive: How AI Is Finally Slashing MRO Costs in Supply Chains
-
R David Moon, CISSP liked thisR David Moon, CISSP liked thisAlways good to catch up with our friends at ARC Excess & Surplus, LLC! Great conversation and company, and always time well spent. 🤝 📸 Reid Orza | Kevin Mashavejian | Rob Balkam | Bruce Simmons | Sharon Adickes | Freddy Shashaty | Adam Zwibel | Cody Olszewski, CPCU | Ted Stefas, Esq. | William Wynne | Craig Landi | Andrew Menger #Partnerships #FalconRiskServices
-
R David Moon, CISSP liked thisR David Moon, CISSP liked thisRichard Pluschau and I had the opportunity last week to attend the Datos Insights Leaders Technology Forum - always a great way to connect with peers across the industry and exchange perspectives. Here are a few key takeaways that stood out: The AI pilot phase is coming to an end - it’s now the baseline. The real challenge ahead is data readiness and deployment maturity. 🔁 The evolution is clear: Predictive → Generative → Agentic Predictive AI is the foundation GenAI is the interface Agentic AI (reason, plan, execute) represents the shift from insight to action 📊 Data remains the biggest constraint Data quality continues to be the top blocker, while legacy integration challenges are increasing as organizations move from pilot to production ⚖️ The build vs. buy equation is shifting AI is compressing build timelines - the conversation is moving from “buy vs build” to “buy to build on” Governance is no longer a constraint - it’s what makes AI repeatable, explainable, and scalable 🏗️ Underwriting is emerging as the next innovation frontier The focus is shifting from claims efficiency to underwriting intelligence, with workbench-driven decisioning and stronger feedback loops into distribution 🧠 Institutional knowledge is a true differentiator Agentic AI doesn’t replace expertise - it depends on it Capturing and structuring that knowledge is what will create long-term advantage 🚶 Execution matters - walk before you scale Understanding workflows, measuring baselines, and designing human-in-the-loop (HITL) architectures are critical to realizing value As always, it’s great to connect with this community and a small network within a very large industry, driving meaningful change together. Falcon Risk Services Gaurav Mistry #DatosInsights #InsuranceInnovation #AI #AgenticAI #DataStrategy #InsurTech #DigitalTransformation #Leadership
-
R David Moon, CISSP liked thisR David Moon, CISSP liked thisLast week, we participated in our first-ever Bring Your Child to Work Day, and it was a big hit! The day included an introduction to the world of insurance, career stories from our executive team, an office wide scavenger hunt, and plenty of fun along the way. A huge thank you to everyone who helped make the day so special, and we can’t wait to do it again. Who knows, we may have met a few future underwriters in the making! 🕵️ #CompanyCulture #FutureLeaders #BringYourChildToWorkDay #FalconRiskServices
-
R David Moon, CISSP liked thisNumbers like 101 participants, 33 countries, 41+ hours — those are impressive. But what stays with me is something harder to quantify: watching women who started the program unsure of their place in cybersecurity finish it knowing exactly what they bring to the table. That shift in confidence is what CS VISOR was built to create. This is a reminder of why this work matters far beyond the product or the business. The next cohort opens Sept 28 — help us spread the word. 🚀 #WomenInCyber #CSVisor #CyberLeadership #InclusionInTechR David Moon, CISSP liked this🚀 𝟭𝟬𝟭+ 𝗺𝗼𝘁𝗶𝘃𝗮𝘁𝗲𝗱 women. 𝟵 𝗶𝗻𝘀𝗽𝗶𝗿𝗶𝗻𝗴 cyber leaders. 𝟭 𝗺𝗼𝘃𝗲𝗺𝗲𝗻𝘁 across 𝟯𝟯 𝗰𝗼𝘂𝗻𝘁𝗿𝗶𝗲𝘀. At CS VISOR, we celebrate the graduation of the first 𝗙𝗥𝗘𝗘 cohort of our "𝗔𝗜-𝗣𝗼𝘄𝗲𝗿𝗲𝗱 𝗪𝗼𝗺𝗲𝗻 𝗶𝗻 𝗖𝘆𝗯𝗲𝗿 𝗣𝗿𝗼𝗴𝗿𝗮𝗺" today. 𝗜𝗻 𝗷𝘂𝘀𝘁 𝘁𝘄𝗼 𝘄𝗲𝗲𝗸𝘀, these great 𝘄𝗼𝗺𝗲𝗻 didn’t just learn — 𝘁𝗵𝗲𝘆 𝘁𝗿𝗮𝗻𝘀𝗳𝗼𝗿𝗺𝗲𝗱. 🌍 𝗚𝗹𝗼𝗯𝗮𝗹 𝗜𝗺𝗽𝗮𝗰𝘁: 𝟭𝟬𝟬+ participants from 𝟯𝟯 𝗰𝗼𝘂𝗻𝘁𝗿𝗶𝗲𝘀 ⚡ 𝗘𝘅𝗽𝗲𝗿𝘁𝗶𝘀𝗲: 𝟰𝟭+ hours of real-world 𝗖𝘆𝗯𝗲𝗿 & 𝗔𝗜 𝗶𝗻𝘀𝗶𝗴𝗵𝘁𝘀 🎯 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: From 𝗰𝘂𝗿𝗶𝗼𝘀𝗶𝘁𝘆 to 𝗰𝗮𝗿𝗲𝗲𝗿-𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝗰𝗲 But numbers 𝗼𝗻𝗹𝘆 𝘁𝗲𝗹𝗹 𝗽𝗮𝗿𝘁 𝗼𝗳 𝘁𝗵𝗲 𝘀𝘁𝗼𝗿𝘆. Behind every stat are real women — from different backgrounds — who showed up, asked the hard questions, and claimed their seat at the table. 𝗪𝗮𝘁𝗰𝗵𝗶𝗻𝗴 𝘁𝗵𝗶𝘀 𝗰𝗼𝗺𝗺𝘂𝗻𝗶𝘁𝘆 𝗰𝗼𝗺𝗲 𝘁𝗼 𝗹𝗶𝗳𝗲 𝗶𝗻 𝗿𝗲𝗮𝗹 𝘁𝗶𝗺𝗲 has been one of the 𝗺𝗼𝘀𝘁 𝗺𝗲𝗮𝗻𝗶𝗻𝗴𝗳𝘂𝗹 𝘁𝗵𝗶𝗻𝗴𝘀 our team has been part of. 👏 𝗧𝗼 𝗲𝘃𝗲𝗿𝘆 𝗴𝗿𝗮𝗱𝘂𝗮𝘁𝗲: Your courage, commitment, and ambition are exactly what this industry needs. 𝗧𝗵𝗶𝘀 𝗶𝘀 𝗻𝗼𝘁 𝘁𝗵𝗲 𝗳𝗶𝗻𝗶𝘀𝗵 𝗹𝗶𝗻𝗲 — 𝗶𝘁’𝘀 𝘆𝗼𝘂𝗿 𝗹𝗮𝘂𝗻𝗰𝗵𝗽𝗮𝗱. 🚀 ________________________________________ 📣 𝗪𝗘 𝗔𝗥𝗘 𝗚𝗢𝗜𝗡𝗚 𝗔𝗚𝗔𝗜𝗡! 🗓 𝗡𝗲𝘅𝘁 𝗙𝗥𝗘𝗘 cohort: 𝗦𝗲𝗽𝘁 𝟮𝟴 – 𝗢𝗰𝘁 𝟵, 𝟮𝟬𝟮𝟲 Know a woman 𝗿𝗲𝗮𝗱𝘆 𝘁𝗼 𝗯𝗿𝗲𝗮𝗸 𝗶𝗻𝘁𝗼 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆? 👉 Tag her 👉 Share this post 👉 Help open a door to her future More Info: 🔗 https://lnkd.in/dF_NawuR ________________________________________ 🙏 𝗦𝗽𝗲𝗰𝗶𝗮𝗹 𝘁𝗵𝗮𝗻𝗸𝘀 to all leaders & institutions & organizations for standing with us in 𝗰𝗹𝗼𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝗴𝗲𝗻𝗱𝗲𝗿 𝗴𝗮𝗽 and 𝘀𝗵𝗮𝗽𝗶𝗻𝗴 𝘁𝗵𝗲 𝗳𝘂𝘁𝘂𝗿𝗲 𝗼𝗳 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 talent. Women4Cyber Foundation || European Commission || European Union Agency for Cybersecurity (ENISA) | European Cyber Security Organisation (ECSO) || EU Digital & Tech || Federal Office for Information Security (BSI) || EU Employment and Skills || Women in Cyber Security || Women in Tech || WOMEN IN TECH ® Global || Women in Technology (WIT) || Women in AI || Women in AI Ethics™ || Women in Tech®Germany || Women in CyberSecurity (WiCyS) || Cyvia || Hybrid Core || Beyond the Horizon ISSG || ISC2 || Exemplar Global, Inc. || CompTIA || Stormshield || Microsoft || Splunk || Trend Micro || Henna Virkkunen || Despina Spanou || Roberto Viola || Renate Nikolay || Debra Taylor, CC || Anett Mádi-Nátor | María Saskia Brugman GA | Selene Giupponi | Margherita Rossi| Joanna Świątkowska, PhD | Annika Wägenbauer | Swantje Westpfahl | Anne-Sophie Diehl || Clémence C. ________________________________________ 💬 The future of cybersecurity is 𝗱𝗶𝘃𝗲𝗿𝘀𝗲, 𝗶𝗻𝗰𝗹𝘂𝘀𝗶𝘃𝗲 — and 𝗯𝗲𝗶𝗻𝗴 𝗯𝘂𝗶𝗹𝘁 𝗿𝗶𝗴𝗵𝘁 𝗻𝗼𝘄. 𝗟𝗲𝘁’𝘀 𝗸𝗲𝗲𝗽 𝗴𝗼𝗶𝗻𝗴. 𝗧𝗼𝗴𝗲𝘁𝗵𝗲𝗿. #WomenInCyber #CyberSecurity #WomenInTech #AI #InformationSecurity #CSVISOR #career
-
R David Moon, CISSP liked thisR David Moon, CISSP liked this⚡ 𝗘𝘃𝗲𝗿𝘆 𝟯𝟵 𝘀𝗲𝗰𝗼𝗻𝗱𝘀, a cyberattack happens somewhere in the world. But here’s 𝘁𝗵𝗲 𝗿𝗲𝗮𝗹 𝗽𝗿𝗼𝗯𝗹𝗲𝗺: Organizations 𝗰𝗮𝗻’𝘁 𝗳𝗶𝗻𝗱 𝗲𝗻𝗼𝘂𝗴𝗵 𝘀𝗸𝗶𝗹𝗹𝗲𝗱 𝗱𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀. The cybersecurity 𝘀𝗸𝗶𝗹𝗹𝘀 𝗴𝗮𝗽 𝗶𝘀 𝗴𝗿𝗼𝘄𝗶𝗻𝗴 — fast. 👉 𝗧𝗵𝗮𝘁’𝘀 𝘆𝗼𝘂𝗿 𝗼𝗽𝗽𝗼𝗿𝘁𝘂𝗻𝗶𝘁𝘆. 🛡️ 𝗖𝗦 𝗩𝗜𝗦𝗢𝗥 𝗔𝗰𝗮𝗱𝗲𝗺𝘆 is launching its next cohort of the 𝗔𝗜-𝗣𝗼𝘄𝗲𝗿𝗲𝗱 𝗖𝘆𝗯𝗲𝗿 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝗻𝗮𝗹𝘆𝘀𝘁 / 𝗦𝗽𝗲𝗰𝗶𝗮𝗹𝗶𝘀𝘁 𝗣𝗿𝗼𝗴𝗿𝗮𝗺 — and it might be the career move that changes everything. 📅 Starts: 𝗔𝗽𝗿𝗶𝗹 𝟭𝟯, 𝟮𝟬𝟮𝟲 ⏱ 𝟴 𝗺𝗼𝗻𝘁𝗵𝘀 | Mon–Fri | 100% Live & Online 🌍 English (+ German support) 𝗧𝗿𝘆 𝘁𝗵𝗲 𝗳𝗶𝗿𝘀𝘁 𝟮 𝘄𝗲𝗲𝗸𝘀 𝗙𝗥𝗘𝗘 — then decide. 🔥 This isn’t just a course. It’s a career launchpad. You won’t sit through recordings and hope for the best. 👉 You’ll train inside 𝗮 𝗿𝗲𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀 𝗖𝗲𝗻𝘁𝗲𝗿 (SOC) 👉 Work with 𝗿𝗲𝗮𝗹 𝘁𝗼𝗼𝗹𝘀, 𝗿𝗲𝗮𝗹 𝘀𝗰𝗲𝗻𝗮𝗿𝗶𝗼𝘀, 𝗿𝗲𝗮𝗹 𝘄𝗼𝗿𝗸𝗳𝗹𝗼𝘄𝘀 🎯 𝗪𝗵𝗮𝘁 𝘆𝗼𝘂 𝗴𝗲𝘁: ✅ 100% live, instructor-led training ✅ Real SOC internship with industry-grade tools ✅ Access to 25+ in-demand cybersecurity roles ✅ Globally recognized certifications ✅ Job coaching, mentoring & lifetime support ✅ Multilingual support (EN / DE / TR) 🎓 At CS VISOR 𝗔𝗰𝗮𝗱𝗲𝗺y, we don’t just train — we transform potential into global success stories. 💥 𝟭,𝟬𝟬𝟬+ graduates have already launched their careers — now working at leading international companies. 🇩🇪 𝟯𝟭𝟬+ placed in G𝗲𝗿𝗺𝗮𝗻𝘆 🇪🇺 𝟰𝟬𝟬+ across 𝗘𝘂𝗿𝗼𝗽𝗲 🇺🇸 𝟲𝟬𝟬+ in the 𝗨𝗦𝗔 💰 It might cost you nothing. 🇩🇪 𝗜𝗻 𝗚𝗲𝗿𝗺𝗮𝗻𝘆? → 𝟭𝟬𝟬% 𝗳𝘂𝗻𝗱𝗲𝗱 𝘃𝗶𝗮 𝗝𝗼𝗯𝗰𝗲𝗻𝘁𝗲𝗿 / 𝗔𝗴𝗲𝗻𝘁𝘂𝗿 𝗳𝘂𝗿 𝗔𝗿𝗯𝗲𝗶𝘁 → Free laptop & monitor included → Zero upfront cost. 🌍 𝗢𝘂𝘁𝘀𝗶𝗱𝗲 𝗚𝗲𝗿𝗺𝗮𝗻𝘆? Or not eligible for AfA → Up to 60% scholarship available 🎯 𝗔𝗽𝗿𝗶𝗹 𝟭𝟯 is your moment. 📩 𝗔𝗽𝗽𝗹𝘆 & 𝗹𝗲𝗮𝗿𝗻 𝗺𝗼𝗿𝗲 → https://lnkd.in/dEKpgNBP 🌐 Explore more: https://csvisor.de/en/ Seats are limited. Don't let this cohort fill without you. Tag someone who's ready to break into cybersecurity 👇 #cybersecurity #informationsecurity #AI #career
-
R David Moon, CISSP liked thisAs Co-Founder & CEO of Cyvia, I’m proud to share that we’ve been acquired by Hybrid Core. This milestone reflects what a small, focused team can build with the right vision and persistence. A sincere thank you to our team and advisors. This success belongs to you. Your execution, resilience, and belief in what we were building made this possible. Cyvia's platform and team join Hybrid Core's existing portfolio under a unified mission: to make intelligence actionable, data sovereign, and defenders ready at every level of the organisation. I’m also excited to now be part of the Hybrid Core team and continue building what comes next, together. Excited for what’s ahead...R David Moon, CISSP liked thisCyvia has been strategically acquired by Hybrid Core. We chose this moment, at INCYBER Forum Europe, to make it official. 🦉 We built Cyvia with a single conviction: the weakest link in any security architecture is not the technology — it is the human operating it. Our AI-powered Virtual SOC was built to fix that. Real adversary TTPs. Adaptive training environments. Every role, every attack surface, continuously updated. Joining Hybrid Core puts Cyvia inside an intelligence infrastructure we could not have built alone — multi-domain data fusion, real-time network intelligence, multi-agent simulation, and a Post-Quantum Encryption layer already operating at sovereign scale. Our defenders no longer train against static scenarios. They operate inside a live, PQE-secured threat picture derived from real signal environments. This is not an exit. It is the architecture Cyvia was always meant to be part of. Adversaries already operate across domains. Now, so do we. For media and investor enquiries: info@hybridcore.eu #Cyvia #HybridCore #StrategicAcquisition #INCYBERForum #CyberDefence #PostQuantum #VirtualSOC #DigitalSovereignty
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
-
The University of Chicago - Booth School of Business
-
-
Activities and Societies: Appointed Leader - Czech Republic Market Economy Transition Team
-
-
-
-
-
-
-
-
-
-
-
Licenses & Certifications
-
Polsky Founders' Circle
Polsky Center for Entrepreneurship and Harry L. Davis Center for Leadership, University of Chicago
Issued -
-
Project Management Professional (PMP)
Project Management Institute (PMI)
Volunteer Experience
-
Architect & Builder
Il Pastor Community Health Clinic, Agua Prieta, Sonora, Mexico
- 3 years 8 months
Poverty Alleviation
Fundraising, design and build of community health clinic, well baby center and daycare facility
Publications
-
Webify: Interconnections of Strategy and Capability in an era of Risk and Volatility
Coyne Press
See publicationKnowing the new challenges of the 21st Century, and the transformation it will continue to bring across society,business, finance, careers and investments, how do we each adjust, and how do we get ourselves in alignment with this emerging and volatile external world?
We examine these issues with a fresh perspective. In a world of volatility, we are all subject to massive shifts in currencies, commodities, career dislocation and investment risk from all directions. More than ever, this…Knowing the new challenges of the 21st Century, and the transformation it will continue to bring across society,business, finance, careers and investments, how do we each adjust, and how do we get ourselves in alignment with this emerging and volatile external world?
We examine these issues with a fresh perspective. In a world of volatility, we are all subject to massive shifts in currencies, commodities, career dislocation and investment risk from all directions. More than ever, this requires a comprehensive reorientation of our approach as managers, career professionals and investors. Webify: examines the new roles of strategy, capability and management, identifying durable practices and trends from a 21st Century perspective.
Projects
-
Grant Thornton International (Chicago, IL, 2012–2014)
-
See projectAccomplishment: $160mm/yr in
shared services operating net savings identified through benchmarked technology consolidation
strategy. Design, planning, budgeting, business model and 5-year deployment roadmap for
greenfield hosted, cloud and dedicated data centers, networks, security and support for 78,000
employee firm across 120 countries -
Grant Thornton International (Chicago, IL, 2012–2014)
-
Accomplishment: $160mm/yr. in shared services operating net savings identified through benchmarked technology consolidation strategy. Design, planning, budgeting, business model and 5-year deployment roadmap for greenfield hosted, cloud and dedicated data centers, networks, security and support for 78,000 employee firm across 120 countries. $1.8mm project (Phase 1); team of 8.
-
Mesirow Financial (Chicago, IL, 2012–2014)
-
Accomplishment: $45mm/yr IT operation
transformed to re-architected and re-organized basis for $11mm in annual savings. Assessment
of enterprise-wide information technology:data, storage, applications, processes, support, financials,
and organization. Development of comprehensive IT re-engineering roadmap addressing
SOA capabilities, data governance, shared services and IT value enhancement. Review of strategic
alignment, cloud solutions, SAN architecture, data hosting options…Accomplishment: $45mm/yr IT operation
transformed to re-architected and re-organized basis for $11mm in annual savings. Assessment
of enterprise-wide information technology:data, storage, applications, processes, support, financials,
and organization. Development of comprehensive IT re-engineering roadmap addressing
SOA capabilities, data governance, shared services and IT value enhancement. Review of strategic
alignment, cloud solutions, SAN architecture, data hosting options, platform consolidation
strategy, vendor contracts and governance practices. Presentation of findings and recommendations
to group CEO, CFO and CIO resulting in approval and funding of comprehensive IT
restructuring program.Other creators -
-
Colony Capital, Los Angeles, CA (2003–2004)
-
Accomplishment: General management of $380mm acquisition of worlds 8th largest hotel from Caesars Entertainment. Complete reconstruction of corporate networks, IT organization, security, data center, and applications for 4,000 employee operation in six months from signing of acquisition. Served as contract CIO; built and managed program management office operating 11 major projects across 214 vendors in coordination with City of Las Vegas, Caesars Entertainment, Deloitte, Nevada Gaming…
Accomplishment: General management of $380mm acquisition of worlds 8th largest hotel from Caesars Entertainment. Complete reconstruction of corporate networks, IT organization, security, data center, and applications for 4,000 employee operation in six months from signing of acquisition. Served as contract CIO; built and managed program management office operating 11 major projects across 214 vendors in coordination with City of Las Vegas, Caesars Entertainment, Deloitte, Nevada Gaming Commission, Las Vegas Convention Center and four labor unions. $49mm program across 11 projects; team of 45.
-
Cosmopolitan Resort Casino, Las Vegas, NV (2006–2008
-
Accomplishment: Technology strategy and infrastructure development for $4bn entertainment group as contract CIO, including requirements analysis, systems design, Web 2.0 strategy, data center build-out, mobility, business continuity, content management, and IT value assessment across 48 business-critical technology systems. $64mm program across 17 projects; team of 23.
-
Mesirow Financial (Chicago, IL, 2012–2014)
-
Accomplishment: Enterprise CISO. Cybersecurity operation transformed to re-architected and re-organized basis for $11mm in annual savings. Led teams up to 43. Assessment of enterprise-wide information technology: data, storage, applications, processes, support, financials, and organization. Development of comprehensive re-engineering roadmap addressing new capabilities, data governance, shared services and value enhancement. Coordination and data gathering across BoD, all senior Partners and…
Accomplishment: Enterprise CISO. Cybersecurity operation transformed to re-architected and re-organized basis for $11mm in annual savings. Led teams up to 43. Assessment of enterprise-wide information technology: data, storage, applications, processes, support, financials, and organization. Development of comprehensive re-engineering roadmap addressing new capabilities, data governance, shared services and value enhancement. Coordination and data gathering across BoD, all senior Partners and executives, hedge fund operations, insurance, wealth management, and PE operations. Review of strategic alignment, platform consolidation strategy, vendor contracts and governance practices. Presentation of findings and recommendations to group CEO, CFO and CIO resulting in approval and funding of comprehensive IT restructuring program. Named CISO in January 2013. $6.9mm in overall project accountability.
-
PIMCO (Newport Beach, CA, 2012)
-
Accomplishment: $12mm in compliance cost reduction in SEC-regulated compliance filing and compliance document management system. Enterprise legal data compliance initiative, satisfying legal processes related to SEC filings and other regulatory agency requirements. Project included data architecture, document classification, secure access provisions, and electronic signature management. $3.8mm project; team of 11.
-
Southern California Edison (Rosemead, CA, 2011–2012)
-
Accomplishment: $33mm/yr mitigation in risk and litigation exposure, personally leading deployment of legal case management and content management system. Development of legal content data management system, including digital transformation and content management for largest electrical utility in the US. $16mm project; team of 35.
Languages
-
English
-
-
German
-
Organizations
-
(ISC)2
-
- Present -
Association for Computing Machinery
-
- Present
Recommendations received
2 people have recommended R David
Join now to viewOther similar profiles
Explore more posts
-
Radian Compliance, LLC
Radian Compliance and Runtime Cyber Defense Announce Strategic Partnership. Chicago, IL — February 23 — Radian Compliance, LLC and Runtime Cyber Defense have announced a strategic partnership designed to provide organizations with the alignment of governance, risk, and compliance (GRC) with technical security control operations to meet the security requirements of frameworks including ISO and NIST. This partnership provides expertise when supporting contractual and regulatory requirements, including CPRA, GDPR and CMMC, as well as technical cybersecurity control evaluation and third-party risk management. Radian Compliance’s GRC practice, maintains a long-standing record of supporting organizations with internal audit, implementation, assessment, and consulting services for management system standards, security, and regulatory frameworks. Runtime Cyber Defense delivers hands-on technical execution and operational security services that transform compliance requirements into real-world, defensible security programs. “Organizations pursuing adherence to one or more security frameworks frequently encounter a disconnect between governance expectations and technical requirements,” said Sally Smoczynski, CISSP, Managing Partner at Radian Compliance. “By partnering with Runtime Cyber Defense, we are able to extend our proven GRC methodologies into the operational layer, helping clients to meet compliance requirements and then sustain them in practice.” “Compliance frameworks are only effective when they are backed by strong, continuously managed security operations,” noted Scott Crabb of Runtime Cyber Defense. “This partnership bridges the gap between governance and execution by aligning Radian’s deep GRC expertise with the technical requirements of security and privacy controls.” Through this collaboration, clients will benefit from: · Governance frameworks, policies and procedures aligned with validated technical controls. · Expanded GRC and technical consulting to include: –Internal audits to include both governance and technical reviews. –Third party risk management. –Managed Detection and Response (MDR). –Vulnerability management and threat mitigation. –Secure cloud operations management to support compliant use of modern cloud environments. –Ongoing advisory and vCISO-style support to maintain post-certification compliance. Together, Radian Compliance and Runtime Cyber Defense deliver a unified approach to compliance for cybersecurity and privacy, helping organizations avoid “checkbox compliance” and instead build sustainable, auditable, and resilient security and privacy programs. Contact Radian Compliance: Info@RadianCompliance.com https://lnkd.in/gutgjhbe Contact Runtime Cyber Defense: Info@runtimecyber.com https://lnkd.in/g-s4m9XX
2 Comments -
The Regiment
SafeHill, a Chicago-based cybersecurity startup formerly known as Tacticly, has emerged from stealth with $2.6 million in pre-seed funding to launch its flagship SafeHill SecureIQ™ Threat Exposure Management platform. The round was led by Mucker Capital and Chingona Ventures, with contributions from Techstars, Chicago Early Growth Ventures, The Source Groups, Virginia Union University, and angel investor Eddie Lou. SafeHill specializes in AI-powered continuous threat exposure management (CTEM), combining automated risk assessment, AI-assisted penetration testing, and expert human validation to prioritize and remediate attack paths before hackers can exploit them. The SafeHill SecureIQ™ platform delivers real-time discovery of digital assets, continuous vulnerability analysis, attack path discovery, compliance mapping, and remediation recommendations—all unified in a single dashboard. By blending AI precision with the strategic insight of ethical hackers, SafeHill aims to cut through the noise, validate real threats, and enable enterprises to proactively secure their environments in today’s rapidly evolving threat landscape. #TheRegiment #SafeHill #Cybersecurity #AIPlatform #ThreatExposure #FundingNews #CTEM #AIForSecurity #Startups #RiskManagement #Pentesting
-
GreyShield Group
New guidance detected on authentication security frameworks. CISA and NIST released draft Interagency Report 8597 addressing protection of tokens and assertions from forgery, theft, and misuse. The draft establishes technical controls for securing authentication mechanisms across federal and private sector environments. Public comment period extends through January 30, 2026. https://lnkd.in/gwJFVj2i Organizations implementing token-based authentication systems should evaluate current protections against the forthcoming standards. The guidance addresses persistent vulnerabilities in identity verification processes that threat actors routinely exploit for initial access. GreyShield Watch continues monitoring authentication security developments. #GreyShieldWatch #Cybersecurity #InfoSec #RiskManagement #SecurityOperations
-
Taft Stettinius & Hollister LLP
California’s new CCPA “cybersecurity audit” requirement is now in effect and it’s not a box-checking exercise. In Taft’s Privacy & Data Security Insights blog, partner Michael Young explains the risks for organizations and executives required to certify these audits under penalty of perjury. Read more: https://bit.ly/4rHgBsy
-
Cynthia Brumfield
Last April, CISA issued an 11-month extension for its CVE program with MITRE, rescuing the program from an almost certain death. Since then, CISA and MITRE have negotiated a new deal that puts the CVE program on firmer footing. In a statement, Nick Andersen, acting director of CISA, told CSO, “Under CISA’s leadership and sponsorship, the CVE program is fully funded and has continually evolved and modernized to support the global vulnerability ecosystem.” My exclusive for CSO. (link in the comments)
-
GoTrustID Inc.
In Sept 2025, NIST published IR 8523 ( https://lnkd.in/gRkwbZ7W ), offering guidance on deploying MFA to protect Criminal Justice Information (CJI) systems. The report highlights the importance of phishing-resistant authentication to prevent credential theft. Hardware security keys using FIDO2 are one effective approach. Idem Key enables phishing-resistant MFA aligned with NIST SP 800-63B AAL2 and CJIS MFA requirements. #Cybersecurity #FIDO2 #CJIS #MFA
-
Cranium AI
🚨 New Blog: Applying NIST’s AI RMF to Third-Party AI: Why Your Vendors Are Your Risk Surface The National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF) has become the gold standard for building trustworthy AI. It isn’t optional — it’s a requirement; and in today’s world, vendor-supplied models and AI services make up a growing share of your ecosystem. That means every third-party system is part of your risk surface, and your governance strategy has to extend beyond your firewall. 💡 What the Framework Really Means for Vendor AI The AI RMF is organized around four core functions—Govern, Map, Measure, Manage. These aren’t abstract principles; they apply directly to vendor AI: 🔹 Govern requires enterprises to establish policies and accountability frameworks that extend to vendors, not just internal teams. 🔹 Map calls for visibility into where and how vendor systems are being used, their intended purpose, and the stakeholders involved. 🔹 Measure demands consistent risk metrics, even when vendors provide only black-box models. 🔹 Manage ensures that remediation and incident response processes are prepared for risks that originate in vendor systems. In short: compliance doesn’t end with your own models. It must stretch across your entire supply chain. Read more: https://hubs.li/Q03KMPf80 #NIST #VendorRisk #ThirdParty #AIGovernance #AISecurity #AICompliance #CraniumAI
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content