About
Transformational leader with 25+ years of experience driving cybersecurity innovation…
Articles by John C.
-
Message to the Marymount University 2025 Graduating Doctorate Class
Message to the Marymount University 2025 Graduating Doctorate Class
I was honored to have achieved the academic excellence award for my doctoral graduating class, and as recipient was…
85 Comments -
Utilization of AI in Cyber Threat Intelligence
Utilization of AI in Cyber Threat Intelligence
With the recent hype on the use of AI/ML models in every part of the organizational operations, cyber threat…
1 Comment -
Persistent Issues for AI
Persistent Issues for AI
Over the course of the past decades, I have been working with various incantations of AI - from the AI Lab in IBM T. J.
-
Social Media and Modern Conflict
Social Media and Modern Conflict
How has social media changed the nature of modern conflicts? To address this question means to look at the definition…
-
A Decade-Old Method for Detecting DeepFakes
A Decade-Old Method for Detecting DeepFakes
Back in 2011, there was a paper on a novel video processing method called Eulerian Video Magnification. A variety of…
-
ZT's Love-Hate Relationship with AI/ML
ZT's Love-Hate Relationship with AI/ML
ZT needs to treat entities requesting data with both access and entitlement controls. AI works best with training data…
2 Comments -
Quotes I Live By
Quotes I Live By
I am perpetually thinking about (and occasionally opining on) leadership topics, critical infrastructure protection…
-
(QGI) Quantum General Intelligence
(QGI) Quantum General Intelligence
I predict a disruption - a major disruption. It will occur as GenAI's progression towards AGI (Artificial General…
-
The AI Morality Divide
The AI Morality Divide
There's been a lot of commentary on the value as well as the luggage that GenAI brings to our internet always-on…
Activity
4K followers
-
John C. Checco, D.Sc. reposted thisJohn C. Checco, D.Sc. reposted thisThe Most Valuable Skill in the AI Era Is Knowing When AI Is WrongThe Most Valuable Skill in the AI Era Is Knowing When AI Is Wrong
-
John C. Checco, D.Sc. shared thisProud to be a Marymount University graduate!John C. Checco, D.Sc. shared thisGreat news: Cybersecurity Guide rated Marymount's DSc in Cybersecurity the best doctoral level cybersecurity program in 2026 Also check my interview with Cybersecurity Guide, available on their podcast https://lnkd.in/e2crmxxe
-
John C. Checco, D.Sc. shared thisSharing to my network ... Juliet is an awesome person!John C. Checco, D.Sc. shared thisHi everyone! I’m seeking a new role and would appreciate your support. If you hear of any opportunities or just want to catch up, please send me a message or comment below. I’d love to reconnect. #OpenToWork About me & what I’m looking for: 💼 I’m looking for Cyber Security Instructor, Information Security Officer, Information Security Manager, and Risk Management Consultant roles. 🌎 I’m open to roles in New York City Metropolitan Area and Washington DC-Baltimore Area. ⭐ I’ve previously worked at Bank of America.
-
John C. Checco, D.Sc. reposted thisJohn C. Checco, D.Sc. reposted thisI’ve spent over two decades in cybersecurity. Alongside CISOs. Advising boards. Sitting in incident rooms. And leading as a CISO myself. And in all that time, the same feedback follows this profession everywhere. “Too technical.” “Speak business language.” “The board won’t understand that.” I’ve heard it so often it has become background noise. And I want to challenge it. Not reject it. Challenge it. And this isn’t just my view. In mentoring conversations with CISOs and those aspiring to step into the role, this comes up again and again. Different organisations. Different industries. Same tension. Yes, a CISO needs to communicate in a way that lands. That’s not the argument. The argument is this: Cybersecurity problems are technical. Not exclusively. But fundamentally. And when we keep asking CISOs to simplify everything, something important gets lost. Not intentionally. Not through lack of integrity. But because there is only so much truth that survives translation. Severity gets softened. Complexity gets smoothed. The uncomfortable becomes comfortable. And the board hears a version of the risk. Not the risk itself. That’s not a CISO problem. It’s a system problem. And we need to call it that. There is a second issue. We place the entire burden of translation on the CISO. The assumption is that executives and boards are the fixed point. The CISO must always move toward them. But when did we stop asking it to work both ways? Boards and executives have a responsibility too. Not to understand every technical detail. But to develop a meaningful understanding of cyber risk. What it is. What it means for the business. What questions to ask. What answers should concern them. Because if that understanding only exists on one side of the table, the conversation will always stay surface level. No matter how well the CISO translates. And here is the moment that exposes everything. Not the boardroom presentation. Not the quarterly report. The incident room at 2am. When something has gone wrong. When decisions need to be made with incomplete information. When there is no time. That’s when technical depth matters. A CISO who has moved too far from the technical reality of what they are protecting will struggle in that moment. Not in the slides. In the crisis. The CISO’s role was never just translation. It is to defend the organisation. Sometimes that means speaking the language of the boardroom. Sometimes it means saying something that cannot be simplified. Sometimes it means holding the technical truth even when the room isn’t ready for it. Because a CISO who only tells people what they can comfortably hear is not defending the organisation. They are narrating it. And narration doesn’t prevent breaches or manages the cyber crisis. Leadership does. #TheCISOMind
-
John C. Checco, D.Sc. shared thisDeflect, Defer, Deny ... Disappointing. https://lnkd.in/eDqD7QqSMCP 'design flaw' puts 200k servers at risk: ResearcherMCP 'design flaw' puts 200k servers at risk: Researcher
-
John C. Checco, D.Sc. shared thisSo proud of my daughter, Melissa Checco … https://lnkd.in/ewDVcQ7Z
-
John C. Checco, D.Sc. shared thisI've always contended that the best way to fight deepfakes is to meet in person.John C. Checco, D.Sc. shared thisThe CIA just published a paper arguing that AI is bringing back dead drops. When the world's most sophisticated intelligence apparatus decides the most secure communication is no communication at all, that should tell you something about where the threat level actually is. Not because the technology failed. Because it succeeded too well. When AI can clone a voice, fabricate a video, and generate a message indistinguishable from one written by someone you trust, the most valuable intelligence asset becomes the one thing AI cannot replicate at the point of contact: a human being standing in front of you. A properly executed dead drop doesn't just move information securely. It confirms the information came from a specific human source rather than a synthetic one. That verification problem is now the central problem of modern espionage. RAND researcher and former CIA officer Thomas Mulligan frames it clearly. The same tools enhancing intelligence collection are making it harder to trust what that collection produces. More capability, less certainty. That's not a paradox. That's the actual threat landscape. Here's what caught my attention as someone who spent years doing this work. The intelligence community has centuries of doctrine built around exactly this problem. When electronic communication becomes compromised, you revert to methods that can't be intercepted, fabricated, or spoofed. You go back to the human. Private sector organizations have no such doctrine. Most don't have a framework for what employees should do when they can no longer trust a voice on a call, a face on a screen, or a message from a known contact. They have IT policies. They have phishing simulations. They have acceptable use agreements. None of that addresses the verification problem. What Mulligan describes as a returning tradecraft priority for case officers is, in practical terms, a human risk problem that every organization now shares. The difference is the intelligence community is already adapting (though, they could do it a bit faster, IMHO). Most companies are still updating their password policies. The lesson isn't to start running dead drops in your parking garage (though I know some of you would love that!). It's that verification protocols, behavioral awareness, and out-of-band confirmation methods aren't Cold War relics. They are exactly what a workforce operating in an AI-saturated environment needs right now. The CIA is going back to basics because the technology gave them no choice. Most organizations are still debating whether to add AI to their tech stack while the threat has already made its decision. That gap has a cost. It just hasn't shown up on your balance sheet… yet. #HumanRisk #InsiderThreat #Espionage #AI #Counterintelligence #CIA
-
John C. Checco, D.Sc. posted thisAnthropic's Mythos should be a wake-up call for development teams to implement secure SDLC and CI/CD processes and tollgates (instead of relying on security teams to mitigate issues post-production) . In the past 40 years we've gone from Waterfall development with human code reviews, to Yourdon methodology with modular coding, to Agile/Lean scrums with self-documenting epics, to Vibe coding building entire systems from simple prompts. It was inevitable - at least to me as a former RPG-II / ASM / C / C++ / Java / Python developer - that vulnerabilities would increase with the continual acceleration and abstraction of development processes without tollgates.
-
John C. Checco, D.Sc. reacted on thisJohn C. Checco, D.Sc. reacted on thisSomeone needs to explain to me why everybody wants to be the most damaged guy in the room now? The fire service used to hide trauma/ addiction because of shame and fear. That was wrong. Now though… some people brand it. Also… wrong. A culture got created where pain is getting applause, suffering gets followers, and whoever tells the darkest story suddenly becomes the voice of the movement. That has nothing to with fixing things - that’s some weird new trauma celebrity. I blame reality tv... It seems “vulnerability” stopped being about helpful honesty and started becoming a branding tool. Now there’s entire identities built around being broken and entire platforms built around staying broken publicly. The uglier the story sounds, the faster people hand over trust. The problem: people are starving for authenticity, for somebody who understands the job, the exhaustion, the anger, the isolation. So when somebody steps onto a stage or a podcast and bleeds emotionally on command… people are mistaking exposure for wisdom. Real healing? Real healing is usually boring and a lot of hard, quiet work. Not exactly great content material. Fixing yourself is stuff like consistency and boundaries or shutting the hell up sometimes and doing the work. It’s going to therapy without posting about it and being a stable human being when nobody’s watching. It’s not turning every wound into a microphone or a selfie video. So many people are doing incredible work in the “mental health” space. Some are genuinely helping save lives with their honest journey by giving people a view of their pain AND the work they’re doing to fix it. That AND is the important part. Others have figured out trauma gets attention… Once attention becomes your whole identity - some people stop healing because the pain became too profitable to let go of. Healing = losing their new fire celeb status and followers. Trauma celebrities do more damage than the damage itself because they give people just enough hope to think they have the answer….but never show the work involved to fix their own problems. End the Trauma Tourism industry. #fireservice #firefighters #mentalheath
-
John C. Checco, D.Sc. liked thisJohn C. Checco, D.Sc. liked thisThis photo shows the two matching hose pieces I had made with the names of the 343 FDNY Heroes killed on 9/11/2001. One was raffled off at FDIC. I will be making more of these for those of you that wish to Never Forget. Left to right - Former FDNY Commissioner Salvatore Cassano who lead the rebuilding effort of the FDNY after 9/11, David Rhodes Editor in Chief of Fire Engineering and Educational Director of FDIC, Ray McCormack Former FDNY Lieutenant and Executive Director of the HEN Foundation and FDNY Chief of Department John Esposito. A very emotional moment to have these men on stage reading to themselves the names of friends we all lost. A special thanks to Mercedes Textiles for the hose donation and Crafty America for their artistry.
-
John C. Checco, D.Sc. reacted on thisJohn C. Checco, D.Sc. reacted on thisThe Most Valuable Skill in the AI Era Is Knowing When AI Is WrongThe Most Valuable Skill in the AI Era Is Knowing When AI Is Wrong
-
John C. Checco, D.Sc. reacted on thisJohn C. Checco, D.Sc. reacted on thisEvery AI conversation right now is about coders. Code generation, autonomous engineers, vibe coding, agentic SDLC. All shaped around code. This is the wrong story. Engineers are 5 to 15 percent of the headcount in most companies. In non-tech companies, closer to 5. We have built our entire AI adoption discourse around the smallest slice of the workforce. A 30 percent productivity lift on 8 percent of headcount is a 2.4 percent lift on the company. Real. Worth paying for. Not the story. A 15 percent lift on the other 92 percent is six times bigger. And in my experience, once non-technical people actually adopt, the actual number is much higher than 15. Two reasons the gain is bigger there. Engineers were already leveraged. Stack Overflow, IDEs, autocomplete, frameworks, and copilots before "Copilot" was a word. The baseline was high. The AI lift is real, but layered on top of decades of compounding tooling. For a controller, an underwriter, a recruiter — the baseline is still spreadsheets, email, and tribal knowledge. The lift on that baseline is enormous. The translation tax is gone. For my entire career as a CIO, the bottleneck was translation. A finance person knew the problem. An analyst wrote requirements. A PM prioritized. An engineer built. Six weeks later: "no, that's not what I meant." That structure is now optional. The person closest to the problem can build it themselves and iterate in thirty minutes, rather than in six weeks. So why isn't every CFO and COO already capturing this? Three reasons. IT and security teams default to "approved tools only," which strangles experimentation before it starts. Training programs are designed by technical people for technical people. A non-developer opens the deck, sees "embedding," and tunes out. Incentive systems punish automation. Automate 40 percent of your team's work, and you get more work assigned — or your headcount cut. Your most capable people will deliberately not automate the things they could most easily automate. What works: champion networks of five to fifteen people across functions. Process owners building their own GPTs and agents. Hobbies as the wedge — people get fluent on personal projects, then bring it to work. Coffee-and-code sessions. Public channels where small wins get celebrated. The AI conversation a year from now should sound less like "we deployed an autonomous coding agent" and more like "we made our 50,000 non-engineers each meaningfully more capable at the work they were already doing." The first story matters. The second is an order of magnitude larger. Almost no one is telling it well. Point your enablement, your governance design, and your executive attention at the 92 percent. The 8 percent will take care of themselves. They always have. Long-form article:
-
John C. Checco, D.Sc. reacted on thisJohn C. Checco, D.Sc. reacted on thisYou gave AI to the 8%. The 92% is where the outcome lives!The AI Productivity Story Is Pointed at the Wrong PeopleThe AI Productivity Story Is Pointed at the Wrong People
Experience
-
███ ████ ████
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
-
-
-
-
-
-
-
-
-
-
-
-
-
Licenses & Certifications
-
-
-
SDRM (Strategic Decisions and Risk Management)
Stanford Center for Professional Development
Issued -
-
-
-
-
-
-
Volunteer Experience
-
-
Firefighter / Emergency Response Diver
Stony Point Fire District
- 27 years 2 months
In addition to my firematic duties, I also run the Clam Bar at the annual Wayne Day Fundraiser, cook for various fundraisers such as the Clam Bake, Pig Roast, Wing Night, et al.
-
Firefighter / Captain
Milton Point Engine 192, City of Rye Fire Department, NY
- 15 years
In addition to my firematic duties, I also was treasurer as well as a firehouse cook for many social events.
-
Judge Advisor / Judge / Robot Inspector / Deans List Interviewer
U.S. FIRST
- 17 years 2 months
Science and Technology
FIRST Tech Challenge - Hudson Valley Qualifiers and Regionals
-
Assistant Hockey Coach (Bantam/Midget)
North Rockland Youth Hockey Association
- 2 years 8 months
Children
CEP-3 certified
Publications
-
Cyber-Physical Coordinated Attacks: The Emerging Complexity of Crisis Management
The Cyber Defense Review (Army Cyber Institute)
See publicationIt is conceivable and probable that today’s adversaries have contemplated – and recruited for – event scenarios in which a physical crisis is pre-ignited by a series of one of more carefully orchestrated cyber incidents.
As extremist groups grow bolder and attract younger more technology-astute prospects, there will be a convergence where both logical and physical attacks methods are used in concert towards a singular goal. These will be much more complex and targeted than the typical…It is conceivable and probable that today’s adversaries have contemplated – and recruited for – event scenarios in which a physical crisis is pre-ignited by a series of one of more carefully orchestrated cyber incidents.
As extremist groups grow bolder and attract younger more technology-astute prospects, there will be a convergence where both logical and physical attacks methods are used in concert towards a singular goal. These will be much more complex and targeted than the typical diversionary tactics we are prepared for today. -
Reframing Data Privacy
IAPP
See publicationAs an organization, ensure the identification, use and storage of consumer information is sufficiently tracked, since this will bolster both the security and privacy of those data elements. The results of this effort will assist with auditing and cyber-insurance compliance and materially reduce the impact radius of any breach.
As an individual, write to your local federal representative, and implore the resurrection of the Data Broker Accountability and Transparency Act of 2020. -
Sacrifice Fly
Independent
See publicationEvery rural and suburban town has at least one – the town idiot – the old fellow that has lived there forever, but doesn’t seem to be able to find their way out of a paper bag. In the urban areas, they thrive in large crowds in the homeless shelters where they are mostly ignored by society. But in rural America, people watch out for their own; regardless of their situation.
-
Zero-Trust: From Aspirational to Overdue
Independent
See publicationSecurity is a resiliency model not an efficiency model, and as such, many organizations have increased their Year-over-Year (YoY) spending on security technologies. But as the threat landscape has been evolving to more targeted people-centric TTPs; the incremental costs of bolt-on security solutions have less of an effective impact resulting in a YoY decreased Return on Investment (ROI) in security spending.
The Zero Trust paradigm re-thinks an organization’s security posture in terms…Security is a resiliency model not an efficiency model, and as such, many organizations have increased their Year-over-Year (YoY) spending on security technologies. But as the threat landscape has been evolving to more targeted people-centric TTPs; the incremental costs of bolt-on security solutions have less of an effective impact resulting in a YoY decreased Return on Investment (ROI) in security spending.
The Zero Trust paradigm re-thinks an organization’s security posture in terms of people-centric threats and data-centric protections, emphasizing the age-old security tenets of “least privilege”, “segregation of duties” ,“continuous verification” and “security by design”. By embedding security at the core infrastructure, Zero Trust introduces a holistic, long-term, resilient, dynamic and cost-effective approach to an organization’s security posture.
There is no “one size fits all” approach to a Zero Trust Initiative; hence we seek to discuss a thoughtful approach to executing (and operating) effectively in this new paradigm. -
The Resilient CISO
Independent
See publicationCybersecurity is a lot like Firefighting, as they both use a (1) Risk-Based Approach coupled with (2) Situational Awareness of Scaffolding Dependencies plus (3) a Good Decision-Making Process to (4) make People a Priority.
The Resilient CISO is not a unicorn. They are merely the right balance of Operational, Academic and Risk-Based approaches required by the organizational culture; but augmented with a People-Centric Foundation. -
Robotic Process Automation: The Promise, the Patterns, the Pitfalls
O'Reilly / Pearson
The demand for content related to RPA is surging, mainly because tactical guides currently do not exist. This field of software is maturing at a rapid pace and is being commoditized to the point where software bots work alongside humans for specific functions within an organization. In Robotic Process Automation LiveLessons, Mike Ogrinz and John Checco demonstrate the significant benefits involved in this red-hot topic and how to get the most out of your automation platforms.
Other authors -
-
InfoSec Due Diligence in the M&A Process
Unpublished
With the maturity of knowledge in the data privacy and protection arena; due diligence in Information Security (InfoSec) practices should be considered a discrete practice that complements the technology and regulatory compliance assessments.
-
Level Two
LuLu
See publicationThis novel leverages the latest scientific theories mixed with urban legend to turn our traditional perception of the world on its side. Entertain your brain, question reality, there is more here than meets the eye.
-
Making Sense of a Biometrics Portfolio in an M&A Strategy
Iris Capital Partners
See publicationTaking the steps to understanding the business of biometrics is to dispel any preconceived notions about biometric technologies, recognize the timing for expansive growth in this market, comprehend the business drivers that influence biometrics technologies, and identify causalities for biometrics in a
thoughtful and creative M&A strategy. -
Virtualization Striping: Providing RAID-like Failover for Applications
WSTA
See publicationVirtualization striping allows enterprises to gain the advantages of CPU optimization, server consolidation and first-level failover strategy. Virtualization and clustering technologies are more
closely aligned than you think.
Patents
-
Optimizing Authentication and Management of Wireless Devices in Zero Trust Computing Environments
Issued US 11381972
-
Data Sharding for Transmission over a High Generation Cellular Network
Issued US 11258854, US 11706299, US 11979460
-
Reverse Proxy Server for an Internet-of-Things ("IoT") Network
Issued US 10848588 B2
-
Blockchain-Based Supply Chain Smart Recall
Issued US 10817829 B2
-
Reflexive benign service attack on IoT device(s)
Issued US 10771502 B2, US 10609069 B2
-
Multi-Biometric-Factor, Internet of Things (IOT), Secured Network
Issued US 11185229 B2, US 10602930 B2
-
Blockchain-Based Unexpected Data Detection
Issued US 10567156 B2
-
Blockchain-Based Supply Chain Certification Systems and Methods
Issued US 11055658 B2
-
Automated Event Processing Computing Platform for Handling and Enriching Blockchain Data
Issued US 11188909 B2, US 11196747 B2
-
Method for Providing Computer-Based Authentication Utilizing [Keystroke] Biometrics
Issued US 7509686 B2
A method and system looks for patterns in a series of data samples to determine consistency or inconsistency within the data sample.
-
Messaging Architecture Supporting Digital and Analog Media
Issued US 5859898 A
A message system includes voice or data messages and which allows such messages to be retrieved at the convenience of the recipient.
-
A Method for Providing Computer-Based Authentication Utilizing Gesture Biometrics
Filed US 20130111580 A1
A method and system looks for patterns in a series of gestures to determine consistency or inconsistency within the data sample.
Projects
-
LinkedOut Browser Extension
- Present
See projectChrome/Firefox browser extension to highlight and automatically hide "promoted ads" from your social media feed.
-
Outlook Client Safety Check
- Present
See projectOutlook client add-on that allows users to passively check an email for "unusual anomalies" - such as spoofed email addresses, IP/host/domain blacklists, zero-width beacon images, misdirected URL content-types, and HaviEBeenPwned integration.
-
bioChec™ Keystroke Biometric Technology
- Present
See projectKeystroke biometrics technology - now available free for in-house development use. Gesture biometrics implementation is currently being developed.
-
ConcurrentLock
- Present
See projectIn a really complex multithreaded application, traditional threading semaphore systems cause EXCLUSIVE access to objects, even if the method does not update any member variables! This results in an object implementation that only allows SERIAL access, not really what was meant by the multithreading capabilities of OO design. ConcurrentLock allows multiple threads CONCURRENT READ access to objects, while preserving object integrity through EXCLUSIVE WRITE access.
-
Resume Histogram
See projectThis application displays a resume in histogram format, and allows employers to compare multiple resumes visually. Originally created as a BBS back in the late 1980's,it has been ported multiple times from C to Java to Ruby/Rails to PHP.
-
Transparent Cooperative Shared Computer Workspaces (T-CSCW)
-
In 1993, prior to what we now know as WebEx/Zoom/Teams, there was this little known research project at NYNEX Science & Technology to bring multi-point user video calls over the ISDN/SDSL to customers. Unfortunately, NYNEXS&T did not see this as their future, so the patent application was never filed. (Imagine if they had!)
Honors & Awards
-
Outstanding Achievement in Excellence
-
-
County Fire Instructor of the Year
Rockland County Fire Chiefs Association
-
County Fire Instructor of the Year
Rockland County Fire Chiefs Association
-
Unit Citation - Swift Water Rescue Team
Rockland County Volunteer Firefighters Association (RCVFA)
Stony Point Fire Department Swift Water Rescue Team received a Unit Citation with regard to a rescue of several youths trapped in swift water during Hurricane Sandy
-
HURST Green Cross Award
Stony Point Fire Department
Life saving activities performed during a vehicle extrication.
Organizations
-
ISSA
President
- Present -
NY Metro Joint Cyber Security Conference
Co-Founder, Chair
- PresentThe New York Metro Joint Cyber Security Conference is the first collaborative event cooperatively developed, organized and sponsored by the following leading information security industry organizations: InfraGard, OWASP, ISSA, ISACA, ISC2, CSA, HTCIA, ACFE, et al.
-
Rockland County Fire Instructors Association
Member
- Present -
New York Metro InfraGard Members Alliance (FBI Outreach Program)
Past President, Board Director
- PresentPresident (2013 - 2018), Board of Directors (2010 - 2018), Cyber Security Awareness Instructor (2010 - 2012), Strategic Planning Committee (2010 - 2012) Secure Member (since 2003).
-
Wall Street Technology Association (WSTA)
Strategic Content Committee Member
- -
ASIS (NY Chapter)
Member
- -
IACSP
Member
- -
INCITS (International Committee for Information Technology Standards)
M1 Biometrics Committee Member
-Worked on the technology standards specification for a keystroke dynamics [signature] capture data format.
Other similar profiles
Explore more posts
-
CISO Tradecraft®
What’s the relationship between threat modeling and risk management? It’s one of the most common questions asked and the answer often surprises people. Threat modeling isn’t just a subset of risk management, it often precedes it. In fact, we handle the majority of threats through good engineering long before formal risk quantification even starts. Risk becomes essential only when we hit edge cases: when threats are unavoidable, when costs get high, or when regulators demand it. Most of the time, we’re building bridges, not running insurance calculations. If you're still approaching security through the lens of “what's the risk?”, it might be time to zoom out. Start with threat modeling. Here's a helpful read from 😷 Adam Shostack on the topic. Check it out. https://lnkd.in/e8g3h32R
-
Richard Staynings
The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh
-
SNH TECHNOLOGIES
🚨 70% of small businesses close within 6 months of a major cyberattack. Don’t be a stat. A resilient business doesn’t just back up data. It defends, detects, and adapts. You need proactive monitoring and real-time threat intelligence so you don't just recover from a cyberattack—you resist it.
-
Private Identity
If your biometric solution stores or transmits biometric data, you’re not just deploying auth—you’re deploying a high-value liability. Centralized repositories become breach magnets. Data in transit widens exposure. And privacy compliance (GDPR, BIPA, HIPAA) becomes an ongoing operational tax. PrivateID takes a different path: ✅ Biometrics run entirely on-device ✅ No biometric data is ever stored or transmitted ✅ Compliance is inherent to the architecture Powered by patented homomorphic tokenization, there’s nothing usable to steal—and nothing sensitive for your team to babysit. Result: passwordless login, secure approvals, and instant recovery— 🚫 no honeypots 🚫 no compliance fire drills 🚫 no “security vs UX” tradeoff Biometrics built for privacy-first security. Rethinking your 2026 authentication strategy? Let’s talk.
-
Offensive Security Manager
Unseen exposures cost more than you think. We routinely see delayed discovery add 3–5x remediation time and multiply breach impact — lost revenue, regulatory fines, and long investigations. With OSM’s continuous AI-driven monitoring, organizations cut escalations, gain a predictable risk posture, and simplify compliance reporting. Our analytics prioritize critical fixes, shorten response cycles, and deliver repeatable evidence for audits. Ready to turn unknowns into measured risk? Learn how: https://wix.to/oSdgdHW #Cybersecurity #RiskManagement #Compliance
-
Cyber Risk Institute (CRI)
This week Cyber Risk Institute (CRI) President & CEO Joshua Magri was on the SRA Watchtower Risk Intel Podcast to discuss the sunset of the FFIEC Cybersecurity Assessment Tool (CAT) and what it means for financial institutions. Key takeaways include: ✅ The CRI Profile is one of four frameworks to consider ✅ But the CRI Profile stands out among financial institutions ✅ With the sunset of the CAT, financial institutions need to focus even more on cyber resilience Give it a listen here! https://lnkd.in/eAtGGQ8u
-
Marion Square Partners
The Department of Defense has introduced the Cybersecurity Risk Management Construct (CSRMC) to replace its outdated Risk Management Framework. This new five-phase approach shifts from static checklists to dynamic, continuous risk management: -Design phase with embedded security from the start -Build phase implementing secure designs -Test phase with comprehensive validation -Onboard phase with automated monitoring -Operations phase with real-time threat detection The framework emphasizes automation, continuous monitoring, and cyber survivability to defend against sophisticated adversaries at the speed of modern warfare. However, some experts question whether this represents substantial change or simply rebranding existing processes: https://loom.ly/3pQGlGI Follow us to stay updated on the latest cybersecurity developments in defense. #Cybersecurity #Defense #RiskManagement
-
Maxxsure
Organizations aligning to National Institute of Standards and Technology (NIST) CSF 2.0 are seeing meaningfully lower growth in cybersecurity insurance premiums. 3% vs. 11% isn’t just a stat—it’s proof that cyber maturity translates into financial impact. Cyber risk isn’t just technical. It’s measurable, insurable, and manageable. If you want to understand your exposure—and what it means in real dollars— connect with Maxxsure. #cyberinsurance #cybersecurity
-
devtech.pro
Critical n8n Security Update: Public RCE Vulnerability PoC Now Available - Florida Today n8n continues to demonstrate its potential in the automation space, but the recent release of a Proof-of-Concept for a Public Remote Code Execution (RCE) vulnerability shines a light on the challenges of maintaining security within low-code platforms. Organizations need to act fast, especially as these vulnerabilities threaten the integrity of workflows and sensitive data. For all its flexibility, n8n must be handled carefully to mitigate exposure to risks like unauthorized access or data breaches. At devtech.pro, our expertise in n8n services ensures that security doesn't become overlooked amidst innovation. We specialize in creating robust workflows tailored to specific business needs while ensuring compliance with the highest security standards. Whether you're setting up integrations or optimizing processes, we help you leverage n8n in a way that balances operational efficiency with top-tier safeguards. Learn more at: https://lnkd.in/d22rNda4 What are your thoughts on this? Don't hesitate to share your thoughts and ideas in the comments below. devtech.pro is always eager to hear from our community and learn about your experiences and perspectives. Looking forward to connecting with you! #devtech.pro #AI #technology #trending #news #innovation #technology This article is written and published by Doki. Doki is our documentation's and social media's AI Agent.
-
Socket
NIST is now under federal audit for its management of the NVD, as delays and data gaps mount. Meanwhile, CISA faces major leadership losses & budget cuts. The #CVE Foundation has proposed a roadmap to fill the gap. Vulnerability infrastructure is at a turning point: https://lnkd.in/gB_X3p7E #cybersecurity
-
ElevenX Capital
**Navigating Third Party Risk in Cybersecurity** The recent guidance from the NYDFS underscores the growing importance of robust risk assessment frameworks for third-party service providers. As companies lean more on TPSPs, they must take proactive measures to mitigate cybersecurity risks. At ElevenX Capital, we recognize that understanding these dynamics is essential for building resilient businesses. How is your organization approaching third-party risk? #investing #innovation #venturecapital #entrepreneurship #cybersecurity
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content