Sohail Iqbal

For too long, cybersecurity has leaned on compliance checklists, periodic pen tests, and static risk models that don't reflect how adversaries actually operate. We measure the presence of controls — not whether they work. That gap is what Jonathan Baker and I set out to address in our new book. It explores how Continuous Threat Exposure Management (CTEM) and MITRE INFORM work together to shift security from assumption to evidence — from "do we have controls?" to "do our defenses actually hold up against real-world adversary behavior?" The core idea: cyber readiness isn't a point-in-time achievement. It's an operational discipline. And it's measurable. If you're a security leader tired of answering "are we secure?" with narrative instead of data, this one's for you. #CTEM #AttackIQ #ExposureManagement #VulnIsDead https://lnkd.in/ewBZAepV

16

CISA’s New SIEM + SOAR Guidance Hits Home for Security Teams CISA just dropped new implementation guidance for SIEM and SOAR—and it’s refreshingly actionable. A few takeaways that resonated: • You don’t need all the logs—you need the right ones. • Response speed improves when context lives closer to the data. • SIEM and SOAR are only as good as the signals feeding them. This is exactly the kind of challenge we’ve been working to solve at Abstract Security. Our approach helps teams: • Prioritize what data gets ingested, enriched, or dropped—before it eats up budget or adds noise • Stream detections in real time, closer to where threats are observed • Deliver cleaner, more actionable inputs into SOAR workflows The goal isn’t more alerts—it’s faster decisions with better context. Worth a read if you’re evolving your SIEM, rationalizing data pipelines, or rethinking what “response-ready” should look like. CISA Guidance: https://lnkd.in/eZEDkJRm Our data strategy e-book: https://lnkd.in/eCvuiVcD #SIEM #SOAR #SecurityOps #Cybersecurity #ThreatDetection #SecurityDataStrategy

54

1 Comment

Your SOC isn’t underperforming. It’s under-equipped. Tip 1 → Integrate CMDB into SecOps ✔️ Every incident ticket should have asset + owner linked. Tip 2 → Use Threat Intel Feeds ✔️ Feed IOCs directly into correlation rules. Tip 3 → Automate Containment for Known Threats ✔️ Block IPs, isolate hosts instantly with playbooks. Tip 4 → Build Role-Based Dashboards ✔️ SOC leads see trends, analysts see action queues. Tip 5 → Keep a Library of Playbooks ✔️ Reuse proven workflows to cut response times. Containment speed isn’t about working harder. It’s about removing the manual steps slowing you down. Follow for more: https://lnkd.in/eM6bbun9 #ServiceNow #SecOps #SecurityIncidentResponse #Automation #ThreatIntelligence #ServiceNowConsulting

4