Scale To Zero

Enterprise Security Restructuring & The AI Vulnerability Boom with Alma Paul

Wed, 05 Aug 2026 00:00:00 GMT

Alma Paul, Senior Corporate Security Engineer at Faire, argues that restructuring an enterprise security program starts with the basics: visibility into what you own, a consistent risk model, a North Star for each security domain, and actually using the tools you already have. On the AI-driven surge in discovered vulnerabilities, she says finding them was never the hard part, fixing them is, so teams should prioritise by business context and use AI to enrich and triage findings. She treats vulnerability management and detection and response as complementary layers, and sees AI as a way to augment security teams rather than replace engineers.

Now more than ever, the basics matter most: know what you have (your landscape, resources and assets) and where you want to get to (your North Star).
Embedding security into the culture early avoids cleanup at a much later point and makes security programs relatively easy to implement.
For vulnerability management, prioritise by business context (public-facing assets, exploitability indicators, application priority) instead of trying to fix every vulnerability.
Avoid vanity metrics: a good program metric tells a story over time of how much risk you have reduced and how much coverage you have gained.
Use AI to augment the security program, offloading repeatable work such as risk reviews and triage context, not to replace security engineers.

The Mythos Era: TPRM Evolution, AI Ethics, and Project Glasswing with Matthew Moog

Wed, 22 Jul 2026 00:00:00 GMT

Matthew Moog, a principal at EY, argues that third-party risk management is moving away from repeated annual assessments toward continuous monitoring of signals such as financial health, resiliency, cybersecurity and zero-day events, run almost like a mini SOC. He estimates AI can take about 60% of the effort out of an assessment, but warns against over-reliance on its output and against turning the savings into headcount cuts. What sets Mythos apart, he says, is that it chains individually minor vulnerabilities into serious ones; he expects more vulnerabilities to patch and more scrutiny of open source code, and sees demand for more technically deep security professionals, not fewer.

Treat assessments as a baseline, not the whole program. Moog rarely sees material year-to-year differences in mature assessments, so he would keep annual deep dives for critical third parties and spend more time on continuous signals: financial health, resiliency, cybersecurity and zero-day events.
AI can remove around 60% of the effort from a third-party assessment, but every answer needs checking. His team's agents cite the policy, the page and a screenshot of the evidence so a reviewer can confirm each one quickly.
Reinvest AI efficiency gains instead of banking them as layoffs: move budget into threat and vulnerability management, incident response, agentic pen testing and security posture management.
Mythos changes the threat picture by stacking vulnerabilities that are minor on their own into a serious one, and by Moog's account about 90% of what it found was in open source, so expect pressure to find and test the open source code across your third-party ecosystem.
Put controls in place before scaling agents. In a lab simulation, a prompt injection hidden as white text in a mortgage file instructed agents to delete a whole bunch of things and was picked up by the roughly 800 rules the team ran in the workflow; uncapped token usage is its own risk, with one organization spending $100 million on tokens in a quarter.

AI: Your Next Tool or New Colleague? Next-Gen Security Skills with Priyanka Chatterjee

Wed, 08 Jul 2026 00:00:00 GMT

Priyanka Chatterjee, CEO of London School of Cybersecurity, argues that AI is the first technology that augments our thinking rather than just automating tasks, which is why she treats it as a colleague rather than a tool. In security operations she would rely on it for reporting, data gathering, triage and investigation, but keeps a human in the loop for response decisions such as taking a machine off the network or disabling an account. For people entering cybersecurity, she says we have moved from a knowledge economy to a skills economy: a portfolio that shows you can apply what you know is what gets you hired, and human agency is what sets you apart.

AI brings an immense productivity gain. Kick-start adoption by automating well-defined playbooks such as data collection, investigation and false-positive detection.
Keep a human in the loop for high-impact response decisions, such as disconnecting a machine from the network or disabling an account, even when AI does the analysis.
We are now in a skills economy rather than a knowledge economy. If you are entering cybersecurity, focus on building skills and a portfolio; it will put you ahead of others in your job search.
Build human agency and use it in your job search and in how you build skills. This is what will differentiate you from others.
Learn to communicate clearly, in speech and in writing. Clear thinking gets better results from your AI colleagues and is what the growing work of AI governance demands.

Beyond the Tools: Bridging Product Security Gaps & Calibrating SDLC with Neelu Tripathy

Wed, 24 Jun 2026 00:00:00 GMT

Neelu Tripathy, Senior Security Architect at Adobe, argues that product security still starts with foundational controls (authentication for every entity including machines and agents, data security, auditing and hardened configurations) with AI-specific controls layered on top. The gaps she most often finds sit in build systems, the supply chain and the supporting services around an application, and rather than adding tools she recommends pushing controls into the platforms, pipelines, registries and golden images engineers already use, so security scales without slowing velocity. For agentic development, she adds a vetted registry for MCP servers and AI tools, registered agent identities, gateway and runtime controls, and security for context.

For product security, start with foundational controls (authentication for every entity, data security, auditing, hardened configurations) and add AI controls as AI usage is introduced.
Build organisational policies and paved roads into engineering practice at every touch point, from IDE checks to build pipeline checks and infrastructure checks.
To collaborate with engineering, provide security systems and platforms and embed controls into existing workflows, working alongside engineering practices instead of replacing them.
Focus on controls rather than detection tools: thousands of untriaged scanner findings overwhelm developers, and issues get fixed when the fix is built into the system and automated.
Treat MCP servers and other AI tools like dependencies: vet them in a registry every time they are imported, and register agents so their actions can be traced.

Ransomware in the AI Era: Evolution, Hidden Weaknesses, and Incident Response with Behnaz Karimi

Wed, 20 May 2026 00:00:00 GMT

Ransomware has shifted from encrypting files to stealing data and multi-layered extortion, and AI systems are now both a target and a weapon. Behnaz Karimi, founder of Tramarena and co-leader of the OWASP AI Exchange, explains how attackers slip malicious models in through the AI supply chain, stay dormant in ML pipelines long enough to evade anomaly detection, and why small and mid-sized companies adopting AI quickly are just as exposed. She argues that isolate-and-restore incident response is not enough for AI: a model that may be poisoned has to be verified, or retrained from scratch in a clean environment.

AI ransomware attacks have many entry points, including models, ML libraries, pipelines, datasets and prompts. Each one deserves equal attention when securing AI systems.
Start with reachability: can a normal IT attack reach your AI systems, and can a compromised AI component affect the rest of your environment? Then review each component, such as the supply chain, pipelines and ML libraries, honestly and prioritize the least secure areas.
Take a moment to analyze your AI systems: inventory the tools and use cases, identify the risks that apply, assess how likely they are and their impact, and set basic controls and governance around them. Repeat whenever your AI systems change.
Isolate, eradicate and restore from backup is not enough for AI. A poisoned model can misbehave long before the attack is noticed, so verify models before restoring them and retrain from scratch in a clean environment if you cannot be confident they are clean.
Small and mid-sized organizations are targets too. Ransomware as a service makes complex attacks easy to launch, and teams adopting AI fast often do not track where their models come from or monitor what enters their systems.

IAM in 2026: From Anti-Patterns to Autonomous AI Agents with Advait Patel

Wed, 08 Apr 2026 00:00:00 GMT

Advait Patel, a senior SRE at Broadcom, argues that IAM in 2026 should unblock engineers rather than slow them down: automate just-in-time access against predefined controls, start from minimal permissions and add more as needed, and build compliance into the infrastructure from day one instead of treating it as a checklist. He says traditional KPIs like mean time to detect and resolve are no longer enough once AI is involved, and proposes measuring signal quality, engineer efficiency, decision quality and automation safety. AI agents are useful for log analysis, root cause analysis and incident runbooks, but he would start them on low-risk tasks and keep humans checking their output, especially as attackers use AI too.

Do not treat compliance as a checklist. Focus on the security basics — patching, visibility, logging, tracking who changed what — and lay a solid foundation from day one; that foundation makes compliance easier too.
Security programs should keep the experience of development, engineering and product in mind. A bad experience backfires and costs security their trust, which is why access that waits days on manual tickets should give way to automated just-in-time access.
Traditional KPIs like mean time to detect and resolve are not enough once AI is in the loop. Measure signal quality, engineer efficiency, decision quality and automation safety, and favour quality over quantity in what the AI recommends.
Build IAM from the bottom up: start from minimal permissions, assign roles by team, and add access as it is needed, rather than granting admin rights and trimming what goes unused.
Start AI agents on low-risk tasks such as log pattern analysis, root cause analysis and incident runbooks. Hand work to autonomous agents only where you are confident in the results without full visibility.

AI Security: Hype vs. Reality and the Roadmap to CISO with Niyati Daftary

Wed, 25 Mar 2026 00:00:00 GMT

Niyati Daftary observes that the biggest AI question for security leaders is defining the CISO's remit in AI governance — many are still unsure of security's role, how to inventory approved AI usage, and which framework (NIST AI RMF or ISO 42001) to follow. She argues the industry overestimates AI's short-term threat, since attackers have not yet leveraged it at scale, while underestimating its long-term value — for example, automating L1 and L2 SOC work. The challenges she hears most are about programme management: aligning the security roadmap to business priorities and demonstrating value to the board.

Product Security at Scale: Minimizing Friction & Defending AI Integrations with Sana Talwar

Wed, 11 Mar 2026 00:00:00 GMT

Sana Talwar shares how to scale product-security programmes while minimising friction for engineering teams. She discusses the unique challenges of securing AI integrations and how to defend against the new attack surfaces they introduce. Her approach emphasises automation, developer enablement, and pragmatic risk prioritisation.

When engaging with Product / Engineering, 3 principles go a long way. Use business language over technical jargons. Highlight Actual risk vs all risks. Automate processes to reduce burden.
Product / Engineering teams should engage security team early in SDLC process to avoid difficult conversation before go live.
For AI Workloads, follow few principles like red teaming of agents, prompt validation, output validation, set guardrails and most importantly have provisions for Human In The Loop.

eBPF, MCP Servers, And The Kernel-Level Future of AI Security with Ammar Ekbote

Wed, 25 Feb 2026 00:00:00 GMT

Ammar Ekbote explains that eBPF hooks into kernel-level activity, which means vendors' monitoring tools need rigorous security testing before adoption. For secure MCP adoption, he recommends enabling org-level hosting, policy enforcement, and approved MCP lists so teams do not install unvetted servers. eBPF can capture developer-level telemetry to detect PII exfiltration through MCPs.

When it comes to eBPF, it’s an event-based technology hooking to kernel-level activity. This means that when working with vendors for eBPF monitoring tools, extra care should be taken to ensure enough security testing is performed before adopting.
For secure MCP adoption, enable teams with allowed MCPs, org-level MCP server hosting, policy enforcement, etc. so that teams do not install MCPs on their own which may lack security guardrails.
Utilize eBPF as a way to capture developer-level telemetry to understand if PII is exfiltrated while using MCPs and apply policies to restrict it.

The Last9 Story: Scaling Engineering, GTM Strategy, and the Reality of "Overnight Success"

Wed, 04 Feb 2026 00:00:00 GMT

Nishant Modak shares the Last9 journey — from the early engineering decisions to building a go-to-market strategy for an observability platform. He discusses the reality behind so-called overnight success, the importance of founder resilience, and what it takes to scale both the product and the team. His candid perspective covers the hard trade-offs founders face at every stage.

AWS vs. GCP IAM Architecture & The Future of Security in 2026 with Sneha Malshetti CISSP

Wed, 14 Jan 2026 00:00:00 GMT

Sneha Malshetti argues that IAM in the cloud is underrated and that teams should start with a clear goal and small scope. She recommends leveraging RBAC, periodic access reviews, and monitoring unused access to optimise over time. Balancing least privilege with developer velocity is equally hard in AI and non-AI worlds, so getting the basics right is what matters most.

IAM in the cloud is underrated. Always start with a clear understanding of the goal and start small. Instead of diving head first with best practices.
Leverage tools & techniques like Role based access control, periodic Access reviews, review unusual access, unused access. Monitor to optimize them.
Striking the balance between least privilege and velocity is hard. The same challenge exists in Non-AI & AI world. So, implement basics really well, utilize above tools & techniques and optimize over time for a better IAM posture.

Zero Trust AI & Human Risk: A Guide to Future-Proofing Security with James Cash

Wed, 26 Nov 2025 00:00:00 GMT

James Cash discusses how zero trust, AI threats, and human risk intersect in modern security programmes. He argues that future-proofing requires addressing all three dimensions simultaneously rather than treating them in isolation. His practical guidance covers programme design, technology adoption, and building a culture that adapts to evolving threats.

Having a good basic understanding of LLM systems, how they work and how they are trained, etc. helps security leaders to prepare & remediate the Risks.
Similar to SBOM for SaaS providers, AI-SBOM is equally important for the AI systems. This helps organizations stay on top of current and potential risks in future.
Least Privilege is a similar challenge in Non-AI & AI world. Access should be limited to least required privilege and also least duration allowed. This helps keep the attack surface to minimum.

Beyond Tech: Building a Security Culture and Navigating AI's Impact with Dakota Riley

Wed, 12 Nov 2025 00:00:00 GMT

Dakota Riley argues that a strong engineering culture drives alignment on security objectives, and that focusing on the problem rather than jumping to a solution is key. He recommends building momentum through small wins and taking calculated risks instead of a risk-averse stance. Secure SDLC, in his view, depends more on practices like threat modelling than on any single tool.

Having a strong engineering culture helps with alignment of Security objectives. Focusing on the problem vs solution is key for strong security implementation.
To address cultural security challenges focus on Small Wins and build from there. Also, take risks vs a risk averse approach to experimentation.
Secure SDLC is more about better security practices like Threat Modeling or Secure Architecture review than tools. Tools help fix the gaps, but they don’t fix the core issue in an organization.

Kubernetes Security Mastery: Shifting Mindsets for Ephemeral Environments with Dinis Cruz

Wed, 29 Oct 2025 00:00:00 GMT

Dinis Cruz argues that a strong engineering culture is essential for securing ephemeral environments because of their dynamic nature. To get the best value from GenAI, organisations must ingest and enrich with high- quality data. Threat modelling is paramount in the GenAI world, ensuring security is woven into every layer of the AI stack — models, data, and applications.

Having a strong engineering culture is key to setting the basics right for Ephemeral environments and Security with it. As the environments are dynamic in nature, vs static infrastructure.
To get the best value out of GenAI, ingest and enrich with good-quality data. This will determine the accuracy of the output from GenAI platforms.
In the GenAI world, Thread Modeling is paramount. This ensures security is integrated, the right way, into each layer of the AI Application stack, including Models, Data, Apps, and others.

Inside the World of an AWS Partner Solution Architect: Career, Partnerships & Scaling with Marketplace

Wed, 15 Oct 2025 00:00:00 GMT

Lalit Khattar shares a candid look at the partner solution architect role at AWS, from building technology partnerships to helping customers scale through Marketplace. He discusses the day-to-day realities of bridging business and technology, what five years at AWS taught him, and how channel- focused go-to-market strategies drive growth.

Securing the SDLC in the AI Era: Challenges and Strategies for Modern Enterprises with Ashish Bhadouria

Wed, 01 Oct 2025 00:00:00 GMT

Ashish Bhadouria discusses the challenges enterprises face when securing the software development lifecycle as AI tools become embedded in the process. He emphasises designing security controls that work with — not against — developers. His approach combines privacy-by-design principles with practical strategies for modern enterprise environments.

Secure SDLC is as much a Culture challenge as it’s a Process or Tools challenge. Having a strong champions program helps with alignment of Security objectives.
Engage early with other teams & stakeholders in the Development cycle. This will ensure Security is not an afterthought rather it’s baked in to the SDLC process.
In the AI world, Thread Modeling is important. This ensures security is integrated, the right way, into each layer of AI Application stack including Models, Data, Apps and others.

Beyond the Hype: A Founder's Guide to Proactive Security & Leadership

Wed, 17 Sep 2025 00:00:00 GMT

Ashish Garg argues that business risk analysis and impact assessment are the keys to successful risk management. Asset management, training, and tabletop exercises form the operational backbone. For cross-team alignment, he recommends engaging leaders on the security roadmap early to build trust and avoid last-minute surprises.

Designing Security for GenAI With Security Specialist Solutions Architect - Shweta Thapa

Wed, 03 Sep 2025 00:00:00 GMT

Shweta Thapa explains that GenAI security controls must account for non- deterministic outputs, novel attack vectors, and semantic validation. She recommends selecting models from trusted providers, validating both input and output, and keeping context front and centre. Guardrails for input/output, authorisation for data access, and feedback loops for bias adjustment are the practical foundations.

While designing Security controls for GenAI applications, a few things should always be kept in mind: 1. Non-deterministic. 2. Different Attack vectors. 3. Semantic validation for output.
Some of the basics of GenAI application architecture include 1. selecting a model from a Trusted Provider. 2. Validate Input and Output. 3. Context matters the most.
To Secure, utilize Guardrails for input and output. Having authorization in place for data access, and a Feedback loop is key for adjusting bias in output.

Beyond the Debate: Security as an Enabler & GRC Maturity with Winthrop Welch, Fractional CISO

Wed, 20 Aug 2025 00:00:00 GMT

Winthrop (Andy) Welch argues that security and compliance shouldn't be at odds: good compliance mandates are security requirements that belong on the program roadmap. He sees GRC maturity as low in many enterprises, where GRC acts as an after-the-fact assessments team, and says it earns its value by moving upstream into development, operations and M&A deal teams. Drawing on a penetration testing engagement, a collapsed acquisition and a healthcare breach response, he shows how trust, shared goals and a value-first approach turn security from a blocker into an enabler.

Instead of debating security versus compliance, treat compliance as a gateway to security use cases and requirements, and prioritize them on the roadmap like any other requirements.
Alignment is the key to collaboration between the security team and the rest of the organization. Building trust and building security champions on the business side goes a long way in designing a successful security program.
The way to beat vendor and tool sprawl is to understand your future state architecture and map out a roadmap to it, then choose the best-fit tool or vendor instead of the new shiny toy.
GRC earns its place by moving upstream: embedding in development, operations and deal teams early, rather than arriving after the fact with a list of findings.
To build a culture of positive friction, start by inviting critique from your direct reports, then widen it once you're comfortable.

The Future CISO: AI, Quantum & Becoming a Multidisciplinary Strategist with Patricia Titus

Thu, 07 Aug 2025 00:00:00 GMT

Patricia Titus discusses how the CISO role is evolving into a multidisciplinary strategist position that spans AI, quantum, and traditional security. She emphasises the need for CISOs to understand emerging technologies deeply enough to make informed risk decisions. Building cross-functional influence and staying current with the changing threat landscape are central to her advice.

With the increasing adoption of AI, Security Leaders would have to become deep specialists. This would enable security experts to not only leverage but also defend against threats.
Context is king. With AI, it’s essential for security leaders to focus on context focused behavioral aspects than the policy driven aspects.
From a governing perspective, NIST and ISO have AI Governance Frameworks. Leverage those as starting points.

Cracking the $3M Deal: Sales Wisdom, AWS Marketplace Success & Life Lessons with Faraz Khan, AWS Marketplace Leader

Wed, 23 Jul 2025 00:00:00 GMT

Faraz Khan shares his experience leading digital transformation for enterprise customers and driving AWS Marketplace adoption. He offers candid sales wisdom on closing large deals, building channel partnerships, and the life lessons that shaped his career in go-to-market strategy.

Zero to Zero Trust: Implementation, Challenges & AI's Future Role with Uttej Badwane

Wed, 09 Jul 2025 00:00:00 GMT

Uttej Badwane discusses the practical challenges organisations face when implementing zero trust, from identity sprawl to legacy-system integration. He explores how AI can accelerate security operations and where it falls short. His advice centres on taking an incremental approach to zero trust and measuring progress against clear milestones.

Zero Trust is a significant initiative and it requires Human effort and budget. Getting Leadership buy-in early would help fast pace the program tremendously.
There are 3 areas of Zero Trust. Identity, Devices and Policy Engine. Having checks and balances at each of these areas are key to the implementation of the Zero Trust program.
AI is a double edged sword. Where in It can help with effective and faster automations. It can also cause damage as well especially with Agent AI / Autonomous decision making AI agents running around and performing actions. Basics of Zero Trust does not change even though the technology changes. Ensure basics are followed properly.

IAM, AI & Cloud Security: Unlocking Scale & Battling New Threats with Stephen Kuenzli

Wed, 25 Jun 2025 00:00:00 GMT

Stephen Kuenzli points out that security is too often treated as a dedicated resource when it should be shared across the organisation, and that least privilege is far more nuanced than it sounds. He argues that security teams should enable others with self-serve playbooks and guardrails like AWS data perimeters. AI's reasoning skills can be leveraged through MCPs and agents to improve research, decision-making, and productivity.

One big misconception when it comes to security, or particularly in IAM, is that folks see security as a dedicated resource versus it's often a shared resource in the organization. And the other one is like least privilege is like very standard, very boilerplate. Whereas it's very nuanced depending on the organization.
The second one is security organization should enable teams by providing self-serve playbooks and also setting up processes around it. Of course, with guardrails on top of it, like using like data parameter in AWS.
AI has reasoning skills, which was missing in software development for decades. So leverage AI, MCPs, agents to improve not only research, but also decision making, and hence the productivity gain.

Beyond the Spreadsheet: Mastering Cybersecurity Risk Management with Joseph Haske

Wed, 11 Jun 2025 00:00:00 GMT

Joseph Haske argues that communication is the single most important aspect of running a risk programme — understanding your landscape and stakeholders' goals is where it starts. He recommends using qualitative methods for decision-making and quantitative scoring for depth. Prioritisation, in his view, must account for other teams' asks before engaging.

Communication is the key aspect of running a successful security risk program. In order to do it well, understand your landscape, understand stakeholders and their goals.
When choosing Qualitative vs Quantitative risk management approach, the framework you can use is use Qualitative for decision making framework and Quantitative for in-depth scoring.
Prioritization plays a major role in risk management programs. Understand your asks and prioritization of other teams in the organization before engaging.

AI in AppSec: The Paradigm Shift with Brad Geesaman

Wed, 28 May 2025 00:00:00 GMT

Brad Geesaman recommends starting small with AI adoption — break work into specific tasks rather than attempting a full overhaul. LLMs are non- deterministic, so teams should define their risk tolerance and optimise around it rather than chasing perfection. He warns that over-reliance on AI systems can erode craftsmanship and curiosity, and advocates using them as an aid rather than a replacement.

Building / Adoption of AI Systems should start small. Breakdown projects into smaller and specific tasks and apply AI on it. Instead of doing a complete revamp at once.
LLMs today are non-deterministic. Define your risk tolerance level and optimize around it. Perfection would be a challenge to building / adoption.
With increased adoption of AI Systems, Complexity Increases, Craftmanship and Curiosity takes a hit. Use AI Systems as a aid vs replacement.

The Good and Lasting Cloud Security with Lalit Kumar

Wed, 07 May 2025 00:00:00 GMT

Lalit Kumar draws on over 20 years of security leadership to discuss what makes cloud security programmes last. He shares lessons from transforming the AWS India Security Division and collaborating with CXOs across BFSI, digital-native, and government sectors. His advice centres on balancing enterprise rigour with the agility that cloud demands.

Scaling Security Champions: From Zero to Hero With Bonnie Viteri

Wed, 23 Apr 2025 00:00:00 GMT

Bonnie Viteri identifies interest in security, knowledge of the tech stack, and integration skills as the signals to look for when selecting champions. She argues that enablement and empowerment are the two key success factors — champions need to learn and to influence. For programme design, she recommends yearly planning, goal-driven metrics, and deep retrospection to understand real impact.

Some of the signals to look for while looking for Security Champions is to see the interest in security, knowledge of tech stack and the understanding of how they integrate.
Enablement and empowerment are two key factors of success of security champions program. This helps security champion to not only learn but also influence security programs.
While designing Security Champions Program, do a yearly planning, make it goal-driven and define success metrics. Perform deep retrospection at the end of the year to understand the impact and areas of improvement.

Securing Production: A Deep Dive into AWS IAM Best Practices with Rowan Udell

Wed, 09 Apr 2025 00:00:00 GMT

Rowan Udell shares deep practical guidance on securing production AWS environments through IAM best practices. He covers least-privilege strategies, role-based access patterns, and the operational trade-offs teams face when tightening permissions without slowing down development.

Visibility of IAM principals, permissions, and activities is key to defining the right IAM policies for the organization. CloudTrail and AWS Access Analyzer help tremendously for this need.
Permissions management is a continuous process. Assign permissions based on need, monitoring them, analyze the usage, and optimize based on the usage. Leveraging some of out of the box IAM capabilities of AWS like AWS Identity Center, SCPs, RCPs, Access Analyzer, Data Perimeter, Session Policies helps in this regard.
Implementation of different IAM best practices like Least Privilege, JIT, etc. depend on organization’s maturity level. These are advanced-level IAM security implementations.

The Secrets of Product Security with Anshuman Bhartiya

Wed, 26 Mar 2025 00:00:00 GMT

Anshuman Bhartiya argues that the foundation of product security is understanding the organisation's risk appetite through a unified approach to risk quantification. He advocates for secure-by-default libraries, golden images, and IDE plugins so insecure code does not fall through the cracks. Culture and empathy toward end-users and engineers are, in his view, what make security programmes successful.

The key to application and product security is understanding the risk appetite of the organization. And in order to understand this, organization needs to have an unified approach to risk quantification utilizing context.
A key trick to incorporate security practices into SDLC is to work with secure-by-default libraries / frameworks. Building golden images, IDE Plugins, Git wrappers, etc. This ensures insecure code does not fall through the cracks.
Culture is key to application and product security. One key aspect of it is to have empathy towards end-users, and engineers. This helps with building relationship with other stakeholders and building relatable & successful security programs.

The Magical World Of Digital Forensics With Jason Jordaan

Wed, 12 Mar 2025 00:00:00 GMT

Jason Jordaan stresses that constant learning is the key to success in digital forensics as technology evolves rapidly. Documentation must be as detailed as possible — leaving even a small gap can derail an entire investigation. Organisations can prepare by setting up logging, training employees on basic forensics, partnering with vendors, and maintaining playbooks.

As the technology moves rapidly, one key skill to success in Digital Forensics is constant learning. Stay up to date with new the tools, technologies like GenAI, Quantum Computing. These bring new challenges and opportunities to Digital Forensic Analysts.
For Digital Forensics, one of the key factors for success is documentation. As detailed as it can get. Because, leaving even a tiny fraction of trace could derail the entire investigation.
In order to help with Digital Forensics, organization can do some basic prep like setting up logging, training employees on basic forensics techniques, partnering with vendors, and have playbooks in place.

From Reactive to Proactive: A Conversation on Modern Threat Detection

Wed, 12 Feb 2025 00:00:00 GMT

Reanna Schultz argues that effective detection engineering requires deep understanding of network architecture, the application ecosystem, and the people on the network. Before marking an alert as a false positive, she recommends waiting for at least three occurrences — the second could be a coincidence. Staying ahead of threats, in her view, relies on security advisories via RSS, Discord, Reddit, and following threat researchers.

For Detection Engineering, understanding your network architecture, application ecosystem and people of network plays a major role.
In order to treat an alert as false positives, wait for at least three occurrences. Second could be a co-incidence. But, marking an alert as false positive on the first occurrence could be misleading. Constantly re-evaluate and verify the audit logs for over corrections.
Best way to stay ahead or close to latest threats is via security advisories. It can be done via RSS Feeds, Discord Servers, Reddit, Hacker news, following threat researchers and more such sources.

The Human Element: AI, Deepfakes, and the Evolving Threat Landscape with Perry Carpenter

Wed, 22 Jan 2025 00:00:00 GMT

Perry Carpenter explores how AI-powered deepfakes and social-engineering techniques are reshaping the threat landscape. He argues that the human element remains the most exploitable attack surface and that awareness programmes must evolve to address AI-generated threats. His practical guidance covers training, detection techniques, and building organisational resilience.

Security with AI can be bucketed into two areas. Detection based (where humans detect the spam using past experience, tone, etc in conversations) and Process based (using tools to block spams).
AI should leveraged for automating tedious manual activities. At the same time it should be verified before the knowledge is amplified.
Measuring security programs should be Impact driven, focusing on outcomes and behavior based assessments rather than only focusing on attendance. Role playing is a key exercise to help employees understand attackers mindset.

From Awareness to Action: Building a Resilient Security Culture with Mauricio Duarte

Wed, 08 Jan 2025 00:00:00 GMT

Mauricio Duarte argues that risk-based prioritisation is the key to successful cybersecurity programmes. Awareness programmes should be behaviour-based rather than tool-based, covering both individual and organisational goals with clear objectives. During incident response, finding the right balance between speed and accuracy matters — analysing before acting improves stakeholder communication.

For the success of CyberSecurity Programs, Prioritization is the Key. Follow a Risk based approach for prioritization.
CyberSecurity awareness programs should be behavior based vs tool based. It should also cover both individual and organizational goals. Most importantly, programs should have clear objectives since the landscape changes frequently be it because of new tools like ChatGPT or new attacks.
In case of Incident Response, find the right balance between speed and accuracy. Analyzing the incident before acting on it helps a lot with Internal and external stakeholder communication.

From Detection to Recovery: Understanding Incident Response Lifecycle with Giorgio Perticone

Wed, 18 Dec 2024 00:00:00 GMT

Giorgio Perticone stresses that one of the most important skills in incident response is staying calm and analysing the situation before acting. Preparation means defining processes, playbooks, documenting the landscape, and planning stakeholder communication ahead of time. Containment is key to limiting impact and preventing repeat attacks — quick decisions backed by solid analysis make the difference.

One of the key skills necessary during Incident Response is to stay calm. Analyze the incident before acting on it. Find the right balance between Speed and Accuracy of Analysis
For Preparedness, Define Processes, Playbooks, Document Landscape and Stakeholder Communication plans to avoid figuring things out during an incident. Reducing the stress on the Incident Response Team.
Containment is key to limit the impact and also avoid repeat breaches / attacks of the same kind. Quick decision making and proper incident analysis will help in containment plan in future.

The CISO's Dilemma: Balancing Security, Innovation, and Burnout with Ross Young

Wed, 04 Dec 2024 00:00:00 GMT

Ross Young argues that CISOs should cross-train beyond their specialty into incident management, GRC, and people management. Communication is essential — he offers two tips: tailor the message to each team, and build champions at the leadership or exec level to promote cybersecurity programmes. Before implementing a new programme, he advises gauging whether it will be cheaper, faster, and better in a year.

Cross-training is key for CISOs. CISOs specializing in AppSec should also focus on other areas like Incident Management, GRC, and People Management to name a few areas. And remember Perfection is the enemy of good.
Communication is an essential skill for CISOs & Security Leaders. 2 Pro Tips. Tailor your message according to the Team.
Similar to Security Champions in Engineering, Socialize and build champions in Leadership or Exec Level so that they become your voice to promote CyberSecurity Programs.
Before implementing a new Security Program, gauge the effectiveness of the program in a year's time. Check if it’s Cheaper, Faster, and better than the current program. This is where hiring/surrounding yourself with experts/smart people will help.

Unraveling the Mysteries of Privacy Engineering: A Deep Dive with Apoorvaa Deshpande

Wed, 20 Nov 2024 00:00:00 GMT

Apoorvaa Deshpande explains that privacy engineering focuses on responsible handling of user data and finding the balance between utility and protection. Privacy by design integrates these practices into each step of the SDLC, reducing rework and hard conversations with other teams. For GenAI, she highlights emerging techniques like secure training, machine unlearning, and data sanitisation.

Privacy engineering focuses on implementing privacy best practices for users and organizations. The core focus is user's privacy and responsible handling of their data. Finding the balance between experience and fatigue is key.
Privacy by design enables teams to incorporate privacy engineering practices to each steps of SDLC. Ensuring less rework, better prioritization and to avoid hard conversations with other teams. Communication plays a major role in this entire process.
For gen AI data privacy, promising technologies such as secure training and inference, machine unlearning are being developed. For today, companies should invest in data sanitization, data governance and using synthetic data.

Getting Started with Cloud Pentesting with Scott Weston

Wed, 06 Nov 2024 00:00:00 GMT

gcpwn (modeled after Pacu) is a great tool for pentesting covering enumeration and lateral movement. There are many more capabilities coming up soon with support for more Services and APIs. Annual Pen Testing is a good start. But, pentesting should be as close to continuous as possible. It helps organizations stay up to date with their attack surface. Scott Weston explains how GCPwn, his open-source tool modeled after Pacu, helps penetration testers enumerate GCP environments and track credential permissions. He advocates for continuous or near-continuous pentesting rather than annual assessments to keep up with evolving attack surfaces. For those new to cloud pentesting, he recommends starting with IAM, since it connects all other services. - "gcpwn (modeled after Pacu) is a great tool for pentesting covering enumeration and lateral movement. There are many more capabilities coming up soon with support for more Services and APIs." - "Annual Pen Testing is a good start. But, pentesting should be as close to continuous as possible. It helps organizations stay up to date with their attack surface." - "When starting to pentest, start with IAM. It connects all other services together and the most impactful. For environments, create a seggregated cloud environment for pentesting and tear it down once it’s not used anymore."

Mastering Zero Trust: A Comprehensive Guide with Dr. Natalia Semenova

Wed, 23 Oct 2024 00:00:00 GMT

Dr. Natalia Semenova emphasises that zero trust is a continuous journey, not a set-and-forget programme. The biggest adoption challenges centre on discovering all assets and identities and understanding their roles. Identity is the core component — an IAM assessment that segregates human, non-human, and external identities helps organisations map their attack surface.

Zero Trust is a continuous journey. It’s not like a set it and forget it type of program. Organizations need to invest not only to set it up initially but also to keep monitoring and improving the program.
For adoption of zero trust, some of the biggest challenges arise from Assets discovery and Identities discovery. Having a clear picture of all the assets, identities and their role in the overall organization.
Identity is a core component of Zero Trust. IAM Assessment and Segregation (between Humans, Non-Humans and External Identities) help organizations understand the Attack Surface and plan for the best possible Zero Trust Policy.

The Ultimate Guide to Cloud Security: A Deep Dive with Richard Stiennon

Wed, 09 Oct 2024 00:00:00 GMT

Richard Stiennon provides a comprehensive look at cloud security, drawing on decades of industry analysis to explain how the threat landscape is evolving. He argues for defence in depth and layered controls rather than reliance on any single solution. His practical guidance covers prioritisation, vendor selection, and aligning security investments with business risk.

Vendor / Platform selection should be based on organization goals. CISOs & Security leaders should prioritize selection based on current posture and look at achieving a set of future goals vs compliance needs or by following a checkbox approach.
Vendor health is an important aspect of determining a platform/vendor. For agent-based solutions, avoid & delay automatic updates from vendors.
When rolling out vendor tools, follow a phased rollout and add the rollout as part of a contract clause. This will push vendors to prioritize implementation, support & training.

Mastering Cloud Incident Response with Hilal Ahmad Lone

Wed, 25 Sep 2024 00:00:00 GMT

Hilal Ahmad argues that a defined incident-response process and team alignment are the foundations of a successful programme. Continuously monitoring MTTD and MTTR drives steady improvement. Out-of-the-box security tools — whether open source, cloud native, or vendor-provided — never offer full coverage; customisation is always needed.

Having a defined Incident Response Process and Alignment among the team are key for a successful Incident Response Program
Monitor your MTTD and MTTR and use that to constantly improve your Incident Response Program.
When it comes to the Security of your organization, Open Source or Native security tools or vendor tools do not provide 100% coverage. It always needs customization as these lack the context.

Rethinking the Framework: Addressing Inherent Cybersecurity Risks with Gretchen Ruck

Wed, 18 Sep 2024 00:00:00 GMT

Gretchen Ruck challenges organisations to rethink how they use frameworks by addressing inherent cybersecurity risks rather than treating frameworks as checklists. She emphasises measuring the actual effectiveness of security controls and adapting programmes as risk evolves. Her practical approach focuses on what matters most to the organisation's threat landscape.

GenAI Tools are good at generic information. But, it often lacks contextual awareness. Building contextual awareness it into the GenAI tooling to get the maximum benefit of this technology trend.
Data privacy & Privacy Enhancing Technology (PET) plays a critical role in organisation’s GenAI strategy. Enough guardrails should be put in place to ensure privacy is at the top of mind.
Inherent risks are difficult to understand. Some of the cybersecurity frameworks gloss over it. But, it’s equally important for success of cybersecurity programs.

Auto Remediation on AWS with Lily Chau

Wed, 11 Sep 2024 00:00:00 GMT

Lily Chau stresses two essentials for cloud security: strong preventive baselines and reactive remediation for drifts. The biggest challenge with remediation programmes is getting buy-in from engineering, DevOps, and leadership — she recommends demonstrating MTTR improvements. Prioritisation of what to remediate is tied to the organisation's security maturity.

There are two essentials to focus in cloud security. Strong security foundations / baselines for preventive measures and remediations for drifts from a reactive measures stand point.
Biggest challenge with remediation programs is buy-in from other stakeholders like Engineering, DevOps, Leadership. To get the buy-in, show the current MTTR vs future golden standard.
Prioritization of remediation is co-related with security maturity of the organization. In areas like Misconfiguration, Threat Intel, Attack Surface amongst others.

Demystifying Identity and Access Management with John Giglio

Wed, 04 Sep 2024 00:00:00 GMT

John Giglio explains that the IAM landscape is always a moving target, so understanding the organisational structure and cloud-service usage is the first step. He argues that when security basics are implemented correctly, compliance follows naturally. For data-perimeter security, he recommends applying different DLP controls for read, write, and download based on user activity and network logs.

In an organization, the IAM landscape is always a moving target. So, understand the organizational structure and usability of cloud services before setting up the foundation.
Security vs Compliance is an age-old debate. When the security basics are implemented the right way, compliance automatically follows.
For data perimeter security, use different levels of controls at DLP. Read, Write, and Download data should have different controls. This should be derived from user activity and network logs.

The intersection of Security and Human Behavior ft. Classie Clark

Wed, 28 Aug 2024 00:00:00 GMT

Cassie Clark argues that infusing security into daily engineering practices — like adding security review to the code-review process — enhances programme effectiveness. Training and awareness should be continuous, actionable, and focused on behavioural risks alongside technical controls. Choice architecture plays a major role: offering a specific password manager or MFA provider, rather than just the concept, nudges better security decisions.

To enhance security program effectiveness, infuse security into daily practices of engineering and others. A simple example could be doing a security review as part of the [code review](https://www.cloudanix.com/blog/top-10-code-security-best-practices-for-developers) process in SDLC.
Training and Awareness programs should be continuous and actionable with a focus on behavioral risks in addition to technical controls.
Choice architecture plays a major role in implementing security programs at organizations. A few examples could be the option of a password manager vs a specific password manager. Option of using a specific MFA provider vs support for multiple providers.

Building Security Foundation and Security Boundaries with Kushagra Sharma

Wed, 21 Aug 2024 00:00:00 GMT

Kushagra Sharma argues that security baselines and boundaries together define an organisation's security foundation — covering network, IAM, infrastructure, and data. Baselining is a continuous cycle of defining, measuring, monitoring, and refining. There is no one-size-fits-all baseline; grouped and layered baselines are the way to scale.

Security baseline along with security boundaries define the security foundation for Organizations. There are various types of security baselines organizations should incorporate like Network, IAM, Infra, and Data.
Baselining is a continuous process. Define it, measure it, monitor it, and refine it using internal and external audits & findings.
There’s no one-size-fits-all security baseline. However, define grouped and layered baselines to scale security practices in organizations.

Trust & Security: The Cornerstones of a Resilient Organization! With Sandeep Agarwal

Wed, 14 Aug 2024 00:00:00 GMT

Sandeep Agarwal argues that trust and security together form the foundation of a resilient organisation. He discusses how to build durable security programmes that survive leadership changes and budget cycles. Aligning security goals with broader business objectives is, in his view, what earns and sustains executive support.

For organizations, alignment between Revenue Goals vs Cost vs Risk is key for success. Instead of teams working in isolation, collaborate to improve the security of the organization.
Security is seen as a team of No. Instead of saying No, security teams should show the path to Yes for business.
The most important asset in Security is not the Tools or Processes but the People. And people consider what they observe as culture vs what’s preached. Practice security basics to set a solid foundation.

Understanding the Continuous Security and Incident Response Landscape

Wed, 07 Aug 2024 00:00:00 GMT

Jan Hertsens recommends that organisations understand the different personas and agendas around compliance and security, then establish a governing body for prioritisation. He advises starting with basic security practices and focusing on one programme at a time. Network segmentation, in his view, plays a major role in incident response by reducing the blast radius.

For the compliance and security debate, understand different personas and their agendas, have a governing body that works with all of these personas, and helps with prioritization.
Always start with basic security practices and focus on one program at a time so that it doesn't get out of hand when it comes to implementing security practices or compliance controls.
Network segmentation plays a major role when it comes to incident response. It helps with reducing the blast radius.

Network Security Fortress: Master Network Segmentation with Tom Adamski

Wed, 24 Jul 2024 00:00:00 GMT

Tom Adamski recommends performing a risk assessment of the business and infrastructure before designing network segmentation — let the drivers (compliance, security, or management) shape the approach. Segmentation should stay at a broader level to remain operable; overly granular rules become difficult to maintain. AWS security tools like security groups, NACLs, subnets, and firewalls are additive, not interchangeable.

Before working on NS, Perform Risk Assessment of the business & infrastructure. Depending on the need like compliance or security or management or others, build your Network Segmentation.
Network Segmentation should be performed more at a broader level instead of very granular. This would become difficult to operate and maintain.
Security tools are AND and not OR in AWS. Depending on the use cases, leverage the security tools and appliances like Security Groups, NACLs, Subnets, Transit Gateways, Firewalls, etc.

Understanding the role of logging and monitoring in detective controls with Kailash Havildar

Wed, 10 Jul 2024 00:00:00 GMT

Kailash Havildar discusses the critical role of logging and monitoring as detective controls in cloud environments. He covers what to capture, how to structure alerts, and the operational practices that turn raw data into actionable security insights. His advice centres on building a monitoring programme that scales with the organisation.

Standardization of logs is very important when designing a Centralized Logging and Monitoring solution. Both from a security and also from an engineering perspective.
When it comes to Logging, start with User Logs, System Logs, Config Logs, Network Logs, in that order to analyze for Detecting Security issues.
For Prevention Controls, start with Regions, Services, Access and Configuration controls. This helps organizations approach security in a structured manner.

Building Cybersecurity Teams with Matthew Marji

Wed, 26 Jun 2024 00:00:00 GMT

Matthew Marji argues that written and oral communication are critical skills for security engineers and should be assessed during hiring. Assessing business risk helps decide whether to hire a contractor, a pentester, or a CISO. Security alignment with the business, in his view, is just as important as engineering alignment.

Communication, both written and oral, are key skills for security engineers and organizations should evaluate for this during the hiring process.
For startups while hiring, assessing the business risk has a huge impact because it helps you decide whether to hire a contractor or a pen tester or a CISO and also whether you should hire someone internally or work with an external agency.
Alignment is key for business success. So similarly, Security alignment is key for success of security programs.

Understanding Threat Modeling and Secure by Design Concept with Adam Shostack

Wed, 12 Jun 2024 00:00:00 GMT

Adam Shostack shares his approach to making threat modelling practical and accessible, emphasising that it is not just for security experts. He discusses secure-by-design principles and how to integrate threat analysis into development workflows. His guidance covers common frameworks, team enablement, and measuring the outcomes of a threat-modelling programme.

Secure by design is a key step in building a healthy security program. It should not be done, or rather it should be done while designing and building applications and not as an afterthought.
When it comes to threat modeling, taking a pause and asking questions about possible threats is equally important as finding a solution to the threats.
Communication is key to evangelizing and championing security programs in the organization. And it goes both ways, security to non-security teams and vice versa.

Conquering Enterprise Risk Management with Amit Subhanje

Wed, 29 May 2024 00:00:00 GMT

Amit Subhanje argues that risk management must balance proactive and reactive strategies rather than leaning entirely reactive. Continuous and targeted training is key to a healthy security programme. Security, in his view, is a shared organisational responsibility — not something confined to the security team.

Risk Management should not only be reactive. It has to have the right balance between proactive and reactive strategies.
Continuous training and awareness programs are key for running a healthy and successful security program. Also, when it comes to training, it should be targeted vs generic.
Security is a Shared responsibility and not a responsibility restricted to security teams. Organizations should nurture a culture where everyone in the organization feel accountable.

Exploring the World of Incident Response and Detection with Pablo Vidal

Wed, 15 May 2024 00:00:00 GMT

Pablo Vidal argues that security engineers should not work in isolation — cross-team collaboration drives programme success. He recommends having a rubric for incident detection and response to reduce stress on engineers during an event. When hiring, both the organisation and candidate should look for mutual fit in skills, goals, and scope.

In order to ensure success of security programs, security engineers should not work in Isolation. Instead, they should collaborate across teams and organization.
For Incident Detection and Response, organizations should have a rubrik. It reduces the stress on engineers to figure out the right plan of action and next steps.
When it comes to hiring the Security Engineers, both Organizations and Candidates should look for Mutual Fit in terms of Skillsets, Future goals and Scope of the work.

Building Cybersecurity Teams and Virtuous Circle With Clients ft. Jesse Miller

Wed, 17 Apr 2024 00:00:00 GMT

Jesse Miller advocates for a culture of knowledge, learning, and growth — it helps both with hiring and retaining security talent. For startups, he recommends hiring a generalist as the first security role to build trust between security and other teams. He favours a risk-centric over a tool- centric approach, arguing that without a solid security programme, tools alone cannot meet security goals.

Create and Practice a Culture of Knowledge, Learnings and Growth. This not only helps you in hiring new Security Roles but also helps in Retaining them.
For a Startup, hire a generalist as a First Role. This helps in Building the Trust and relationship foundation between Security and other Teams for Longer Term.
Follow a Risk Centric vs a Tool Centric Approach for building Security Practice in the Organization. Unless you have a solid security program, tools can’t make you meet your security goals.

Beyond the Basics: Understanding Threat Hunting and Security Research with Josh Pyorre

Wed, 03 Apr 2024 00:00:00 GMT

Josh Pyorre explains that threat researchers use hunting to learn about trends and correlations, narrowing their focus and raising awareness inside organisations. He stresses that following a checklist limits discovery — creative, out-of-the-box thinking is what finds novel attacks. GenAI is a boon for researchers but needs guardrails to prevent data leaks and new AI- inspired attacks.

Threat researchers use threat hunting to learn about trends, and correlations, to narrow focus of the research. And they use this information to watch for other threats and also to help bring awareness in organizations.
Threat research needs creative and out-of-the-box thinking. By following a checklist, threat researchers often do not get, often do not find out novel or unique attacks. So it doesn't help. It doesn't aid in threat hunting process.
GenAI platforms are a boon for researchers. They can quickly get started, learn about new attack vectors. At the same time, guardrails should be put in place to ensure that data is not leaked or employees should be trained to learn about new GenAI-based or inspired attacks.

Keeping Pace with Cloud Security: A Guide to Maturity Models with Rich Mogull

Wed, 20 Mar 2024 00:00:00 GMT

Rich Mogull argues that cloud security demands a different mindset from on- prem and that a maturity model helps bridge that gap. The biggest challenge is expectation setting — working with leadership to define what is realistic. He recommends evaluating your current level, setting a clear goal, and tracking progress toward it.

When it comes to Cloud Security, it needs a mindset shift vs on-prem security. And Cloud Security Maturity Model helps with that.
Biggest challenge with Adoption of Cloud Security Maturity Model is expectation setting. Work with Leadership to set the right expectations.
Before acting on Maturity Model, evaluate the current Level, set a Goal and work towards it. This helps teams to monitor, measure, communicate about and achieve the goal.

The Cloud Security Saga with Joseph South

Wed, 21 Feb 2024 00:00:00 GMT

Joseph South argues that teams should focus on basic and common cloud misconfigurations first, tackling edge cases only after those are resolved. Securing the pipeline is essential for prevention — infrastructure deployed into the cloud must be verified before it lands. He recommends the Cloud Security Alliance's Cloud Controls Matrix as a starting point.

Understanding the concepts of Supply Chain Security, Container Images, SBOMs, and more with Aung

Wed, 07 Feb 2024 00:00:00 GMT

Htet Naing Aung argues that SBOMs are key to supply-chain security, helping organisations understand dependencies and their vulnerabilities. He recommends integrating a software-composition-analysis tool into the CI/CD process. For image signing, best practices include using a key-management solution with rotation, secure root and private keys, and a trusted registry with continuous monitoring.

Software Bill of Material (SBOM) is key for Supply Chain Security. It helps organizations understand dependencies and vulnerabilities associated with the dependencies.
To analyze SBOMs, utilize a Software Composition Analysis (SCA) Tool and integrate is as part of CI/CD Process.
Some of the best practices of Image Signing are using a Key Management Solution which has capabilities like Rotation, Secure Root and Private Keys, Use of a Trusted Registry with Continuous Monitoring on it to name a few.

Navigating the Identity and Access Management Landscape with Joseph South

Wed, 24 Jan 2024 00:00:00 GMT

Joseph South argues that cloud IAM requires a fundamentally different mindset — once credentials are compromised, attackers gain access to all infrastructure, making IAM the new perimeter. He recommends tagging IAM resources, cleaning up inactive roles with over-permissions, and optimising duplicates. Leadership buy-in is essential for enforcing best practices collaboratively.

Security of Cloud IAM requires a different mindset than traditional IAM. Once credentials are breached, attackers gain access to all infrastructure in a Cloud environment. This is one of the Primary Reasons why IAM is the new Perimeter.
To address IAM security gaps, start with Tagging of IAM Resources, Cleanup Inactive, Roles with Over Permissions, and optimizing duplicate permissions.
Security Buy-In is key from Leaders. This helps Security teams collaboratively enforce Security Best Practices.

Unlock the Secrets to Successful Cloud Security with Andre Rall

Wed, 10 Jan 2024 00:00:00 GMT

Andre Rall shares what separates successful cloud security programmes from those that struggle. He emphasises building strong foundations — identity, access, and visibility — before layering on advanced controls. Aligning the security roadmap with the overall cloud strategy and demonstrating value to leadership are, in his view, the keys to sustained investment.

IAM is the critical component when moving workloads from On-Prem to Cloud. Special attention should be paid to Right Sizing of Permissions early on as part of Cloud Security strategy.
Visibility of Cloud Assets is important. Implement Automation for workloads and follow DevSecOps best practices to ensure Security is incorporated in all phases of SDLC.
When it comes to filling Cyber Security skill gap, start with Hands on Webinars, Workshops, attend Cloud Security conferences and go for Certifications to validate your learnings.

Guardian Code: Safeguarding Applications in the AI Era with Jim Manico

Wed, 27 Dec 2023 00:00:00 GMT

Jim Manico advises teams to trust but verify code generated by AI tools — always run it through static and dynamic scans in the DevSecOps pipeline. During prompt engineering, he recommends avoiding sensitive data and requesting low cyclomatic-complexity output. On top of any framework's built-in protections, teams should still apply OWASP Top 10 security best practices.

When it comes to Code generation using Gen AI tools, Trust but Verify. Always run those through your DevSecOps pipelines for Static & Dynamic Scans.
During Prompt engineering, stay away from feeding sensitive information and ask for Low Cyclomatic Complexity recommendations. It’s simpler and easier to maintain.
On top of adding Security capabilities, when using any framework like React or Ruby on Rails, use them securely and apply application security best practices on top of it. Like OWASP Top 10 recommendations.

Guardians of Trust: Navigating Third-Party Risk Across Business Realms with Jeffrey Wheatman

Wed, 13 Dec 2023 00:00:00 GMT

Jeffrey Wheatman argues that vendor security questionnaires go stale within a month and continuous assessment is far more important. Prioritising vendors by business value and impact — categorising them as critical, important, or nice-to-have — prevents overwhelm. For procurement decisions, understanding the cost-vs-value factor is essential since security is ultimately accountable.

Security that speaks to heart; understanding emotional intelligence and third-party risk management with Shivani Arni

Wed, 29 Nov 2023 00:00:00 GMT

Shivani Arni explores how emotional intelligence strengthens security leadership — understanding team dynamics, stakeholder motivations, and organisational politics. She discusses third-party risk management strategies and the importance of balancing due diligence with operational pragmatism. Building trust with partners and internal teams is, in her view, what makes security programmes sustainable.

From a culture perspective, create an environment where your Team feels comfortable in taking Risks. Without Risk Taking, there’s no Innovation.
When it comes to Security, show the ROI to the Leadership and do not forget to recognize effort and celebrate small wins.
Assign Tiers to vendors based on Business Criticality. This helps in prioritization in future.

Identity and Access Management in the Cloud: Beyond Mere Access Control

Thu, 16 Nov 2023 00:00:00 GMT

Chad Lorenc recommends mapping IAM improvements to business outcomes — cost savings from audits, developer productivity gains, and faster MTTD/MTTR. To keep cloud security manageable, he advises consolidating data sources like SIEM, SOAR, and IDS/IPS and monitoring posture continuously. For production accounts, he argues for zero human access and no access keys — use IaC and pipelines instead.

To Show Value of IAM improvements to Leadership, map them to outcomes like Cost Improvement from Audit/SOX perspective, Developer Productivity Gains via Provisioning improvements and MTTD & MTTR from Incident Response perspective.
To keep Cloud Security complexity to minimum, bring all your data sources (like SIEM, SOAR, IDS/IPS) together and Monitor your Security Posture.
For your Production Account security, avoid providing access to Humans and definitely a no Access Keys. Implement IaC and Pipelines for Provisioning.

Unleash the power of DevSecOps and Cloud-Native Security with Kayra Otaner

Fri, 10 Nov 2023 00:00:00 GMT

Kayra Otaner discusses how to bring DevSecOps and cloud-native security together in a way that empowers rather than blocks engineering teams. He shares strategies for embedding security into the pipeline, choosing the right tools, and measuring the impact of a DevSecOps programme. His focus is on practical, achievable steps for teams at any maturity level.

Organizational alignment is the most important factor for Security roadmap. Pro tip - when speaking with Business, Security Teams should use the Business Language instead of Technical Language.
Build a One team culture. Brown Bags, Lightning Talks, Dojos, etc are great ways to collaborate with Engineering and Product teams to build relationships, show value and impact of Security function to other parts of the organization.
When it comes to Cloud Migration, Lyft and Shift does not work. Follow Cloud Best practices from a packaging and containerization perspective. And, focus on 4 Cs - Code, Container, Cluster and Cloud from a security perspective.

Revolutionize your approach to SDLC using DevSecOps techniques with Matt Tesauro

Fri, 27 Oct 2023 00:00:00 GMT

Matt Tesauro argues that DevSecOps should be integrated at every stage of the SDLC, not bolted on at the end. He leverages automation to maximise team velocity and advocates for training both emerging and senior security professionals. Open-source projects and community involvement, in his view, are essential drivers of DevSecOps adoption.

Context is key. When looking at Vulnerabilities do not just look at CVSS Base score, instead, understand your Risk Profile and add the Environmental elements for better prioritization.
In order to adhere to DevSecOps practices, be pragmatic. Instead of a Big Bang approach, start small and iterate to incorporate Security into existing DevOps practices.
When it comes to Prioritization of findings from SAST or SCA or Vulnerability Management or Security tools in general, Let the Security team jump in and add context to help with information overload and prioritization.

Shielding Your Supply Chain: Strengthening Security Measures with Francois Proulx

Fri, 13 Oct 2023 00:00:00 GMT

François Proulx argues that application security should start with threat modelling that includes full architectural context, thinking like an attacker. For open-source dependencies, he recommends a baseline vulnerability scan followed by a continuous review process. Understanding SBOMs and verifying dependency validity — using tools like deps.dev — is essential for supply-chain security.

For Application Security, start with Threat Modeling including Context. Look at all our architecture diagrams and start evaluating from an attacker's mind.
When using Open Source dependencies, start with a Baseline Vulnerability Scan and do a continuous process to review and evaluate dependencies.
Understand dependencies, SBOM to verify validity of dependencies. One of the tools to do this is deps.dev.

Understanding Vulnerability Management, Supply Chain Security, & SBOMs with Yotam Perkal

Fri, 29 Sep 2023 00:00:00 GMT

Yotam Perkal discusses how SBOMs and vulnerability management intersect, giving organisations a clearer picture of their software supply chain. He argues that prioritising vulnerabilities by context and exploitability is more effective than treating every CVE equally. His practical guidance covers tooling, process design, and making vulnerability management sustainable at scale.

Context is key when it comes to Vulnerability Management. Instead of focusing on Vulnerabilities by severity, organizations should evaluate the exploitability and actively exploited vulnerabilities for Prioritization.
When looking at Vulnerabilities do not take CVSS Base score at face value, organizations should understand & utilize Temporal and Environmental elements and the score as well.
From a Supply Chain Security perspective, start with basics like SBOM to help with Visibility and add additional layers like CISA KEV Threat Intel, EPSS Score, Asset Information & SSVC for context and prioritization.

Navigating Threat Modeling and Vulnerability Management Challenges with Kalyani Pawar

Fri, 08 Sep 2023 00:00:00 GMT

Kalyani Pawar argues that deep understanding of a particular capability combined with an overview of the entire architecture is critical for threat modelling. To scale security, she recommends checklists, involving all teams, and investing in a security-champions programme. Security is a journey, not a destination — celebrating small wins makes a real difference.

Detailed Understanding on particular capability with overview of entire architecture is very important from a Threat Modeling perspective.
Create Checklists to scale security in an organization. Involve all teams, and when possible invest and nurture a security champions program.
Security is a journey not a destination. Celebrate small wins. We often miss to do this. They make a lot of difference.

Understanding the Role of Asset Management and Kubernetes in the Cloud with Kesten Broughton

Fri, 25 Aug 2023 00:00:00 GMT

Kesten Broughton argues that asset management and visibility are the foundation of any cloud security programme — you cannot protect what you cannot see. He discusses the unique challenges of managing assets in Kubernetes environments and how to build an inventory that keeps pace with dynamic infrastructure. His practical advice focuses on automation, tagging, and cross-team accountability.

When it comes to asset management, always start from outside in, like DNS, to understand your dangling subdomains or public IPs, which are sort of overexposed and work your work towards inside of your infrastructure.
For asset inventory, get data from multiple sources so that you can use that to enrich the data that you have in your data lake.
Security teams should understand the point of friction with engineering teams and enable them to move faster and roll out more and more features.

Practical strategies for defending a Kubernetes cluster with Divyanshu Shukla

Fri, 04 Aug 2023 00:00:00 GMT

Divyanshu Shukla walks through hands-on defensive strategies for Kubernetes clusters, covering detection techniques and security best practices. This is the final part of a three-part series that moves from fundamentals to attack simulation to defence, giving practitioners a complete picture of cluster security.

Restorative Justice Framework: A New Way to Solve Conflict with Michele Chubirka

Fri, 28 Jul 2023 00:00:00 GMT

Michele Chubirka introduces restorative justice as an alternative framework for handling security conflicts and breaches within organisations. The approach centres on repairing harm, restoring relationships, and learning from incidents rather than defaulting to punitive measures. She argues this mindset can improve trust and collaboration across security teams.

First Security hire for an organization should be a Generalist and has necessary soft skills to work with other teams to improve overall security. Soft Skills and Relationship building is key at the early stage of an organization.
Security Champions are important for a successful Security program implementation. Collaborate with Engineering and enable them to own the Security Roadmap.
When it comes to Kubernetes, Cloud providers abstract security for the managed pieces. Self hosting is another option but it brings many operational, security challenges with it. Unless absolutely necessary for business reasons, avoid self hosting and use a cloud managed k8s offering.
For Kubernetes security, use of Open Source tooling is a good start. On top of that, follow a threat modeling approach rather than just a checklist approach.

Workshop on Attacking a Kubernetes Cluster

Fri, 14 Jul 2023 00:00:00 GMT

Divyanshu Shukla walks through approaches for attacking a Kubernetes cluster from a red-teaming perspective, helping defenders understand how attackers think. This is part two of a multi-part series, following the fundamentals covered in part one. He covers exploitation techniques, common cluster weaknesses, and the tools attackers use in the wild.

Master the art of Incident Response, Digital Forensics, and Threat Intelligence with Gerard Johansen

Fri, 07 Jul 2023 00:00:00 GMT

Gerard Johansen argues that playbooks are critical to every phase of incident response — evidence collection, triage, and retrospection. The four key factors to understand are initial access, execution, lateral movement, and command-and-control. Training engineers on architecture, data flows, and evidence preservation is a must for effective response.

Playbooks have an important role in the Incident Response Process, from all aspects, including Evidence Collection, Triage, Retrospection.
There are 4 key factors which need to be understood in Incident Response - Initial Access, Execution, Lateral Movement and Command & Control.
Training your engineers on Architecture (Cloud or Hybrid setup), Data flows, Evidence Collection & Preserve methods is a must for ideal Incident Response.

Attacking and Defending Kubernetes Cluster with Divyanshu Shukla

Fri, 30 Jun 2023 00:00:00 GMT

Divyanshu Shukla walks through Kubernetes security from both the attacker and defender perspective in a workshop-style episode. He demonstrates common attack paths against clusters and pairs each with the corresponding defensive measures and detection techniques.

Cloud-Native Realm: A Comprehensive Look at Kubernetes Security with Steve Giguere

Fri, 23 Jun 2023 00:00:00 GMT

Steve Giguere argues that Kubernetes is not a universal solution — the right choice depends on company growth stage and team expertise, and monoliths can be better in some cases. He advocates shifting left with policy-as-code, SCA, code signing, and SBOM generation in the pipeline. Before adopting open-source tools, teams should evaluate contributor support, community engagement, and release frequency.

Digging Deeper on DevOps & DevSecOps with Kyle Fossum

Fri, 16 Jun 2023 00:00:00 GMT

Kyle Fossum acknowledges that security is additional overhead for DevOps but argues that self-serve tooling eases the gap between engineering and security. Best practices include keeping secrets out of code, standardising through config management and IaC, and investing in observability. He strongly recommends hardware security keys like YubiKeys over SMS or time- based MFA.

Security is definitely an additional overhead for DevOps practices. Self-Serve tooling helps ease the gap between Engineering and Security.
Some of the best practices of DevOps are: Do not embed secrets in Code. Follow Standardization via Config Management, automation (IaC) and Observability.
It’s highly recommended to use Hardware Security tokens like Yubikeys vs SMS or Time based authentication tools for MFA. Use SSO for user management.

Master Application Security, Threat Modeling, and Security Resilience with Dustin Lehr

Fri, 09 Jun 2023 00:00:00 GMT

Dustin Lehr advises organisations to start by securing production systems and then work backwards toward the source code, bridging the gap between the ideal and the current state. He acknowledges that security is not always the top priority — a pre-product-market-fit startup may rightly prioritise growth. For security champion programmes, he emphasises long-term relationships, speaking the right language, and demonstrating value with clear metrics.

For an organization starting to incorporate Security into their systems, start right (as in securing your Production Systems) and make progress towards securing the Source Code. This helps bridge the gap between best case scenario and current state.
Security is not always the highest priority. Depending on the stage of the organization, Business Growth is of higher priority than Security. For example, a pre-product market fit startup.
Security is driven by culture of the organization. For a security champion program to work, focus on Building Long Term relationships, Communicate using the right language and show value by using the right metrics among other things.

Uncovering The Secrets Of Threat Modeling With Brook Schoenfield

Tue, 06 Jun 2023 00:00:00 GMT

Brook Schoenfield shares how to make threat modelling a practical, repeatable part of the design process rather than an academic exercise. He discusses scaling threat modelling across teams and embedding it in the development lifecycle. His guidance covers common pitfalls, proven techniques, and how to measure the value threat modelling delivers.

Threat Modeling is a continuous activity and should be part of every phase of SDLC starting from Design phase itself.
For Threat Modeling, start with something as simple as STRIDE framework and as the organization matures, review and utilize other frameworks as needed.
For resource constrained organizations, start with Open Source like Semgrep or use Community versions of Security tools to improve Code Security before investing in Wholistic & Expensive Tools.

Comprehending Security Culture with Ariel Shin

Fri, 26 May 2023 00:00:00 GMT

Ariel Shin argues that finding the right balance between speed and security is a shared prioritisation exercise, not a security-only concern. She sees the security team as an adviser while product and engineering own implementation, making strong cross-team relationships essential. Empathy, in her view, is a key skill that helps security teams demonstrate value to stakeholders.

Finding right balance between Production Speed and Security is all about right Prioritization. It’s a shared responsibility between Security & other teams.
Security Team is an advisor where as Product & Engineering owns the implementation. So, building relationship with other Teams is highly important.
Empathy is one of the key skills for Security Teams. It helps with showing value to stakeholders when getting budget, resources, etc.

Learning Application Security With Chris Romeo

Fri, 19 May 2023 00:00:00 GMT

Chris Romeo argues that AppSec is not just about tools — people, process, and governance are equally important. For resource-constrained organisations, he recommends starting with open-source tools targeting high- impact areas before investing in expensive products. Rather than following every OWASP guideline, a data-driven approach that targets the highest-value areas of CI/CD and supply-chain security is more effective.

Security Tools does not mean AppSec. There are other factors to Security as well like People, Process and Governance.
For resource constrained organizations, start with Open Source to improve Security for high impact areas before investing in Wholistic & Expensive Tools.
Instead of following all the best practices like OWASP Top 10, and others follow a Data Driven approach and pick High Value sections for CI/CD Security, Supply Chain Security and other areas.

Data Loss, DevOps, and More!

Fri, 12 May 2023 00:00:00 GMT

Chris Hodson argues that threat modelling is the highest-return activity for incorporating security into the SDLC — especially when you train the whole team to spot gaps. When engaging other teams and executives, he recommends speaking their language and showing how security adds business value rather than flashing dashboards. There is no one-size-fits-all approach to DevSecOps; it always depends on industry, budget, and resources.

Threat modeling is key for incorporating security in each phase of SDLC. More importantly, training the team to look out for gaps in security and then using that for threat modeling will have the highest return for organizations.
When working with other teams and execs show how security can bring in value and use the language that resonates with them instead of showing off the capabilities or dashboards from different security tools.
No one size fits all approach when it comes to security or DevSecOps. It always depends on the industry regulations, budget, resource availability, and many more factors.

Understanding Jupyter Notebooks with Ashwin Patil

Fri, 28 Apr 2023 00:00:00 GMT

Ashwin Patil explores how Jupyter notebooks can be applied to security — from threat detection to forensic analysis and interactive investigation workflows. He discusses the benefits of combining code, visualisation, and narrative in a single document for security teams. His practical examples show how notebooks improve collaboration and reproducibility in security operations.

When it comes to threat hunting exercises, instead of focusing on the top fives of the world, focus on areas which are applicable and can be exploited in your architecture.
As part of your incident response plan, conduct frequent fire drill or tabletop exercises to evaluate preparedness.
Learning from a security incident is one of the best ways to improve threat hunting process.

Understanding Threat Modeling with Jeevan Singh

Fri, 21 Apr 2023 00:00:00 GMT

Jeevan Singh discusses how to embed threat modelling into development workflows without overwhelming teams. He shares practical techniques for scaling security practices when resources are limited. His advice covers prioritisation, tool selection, and building a threat-modelling culture across engineering teams.

Threat modeling is the most cost effective way to improve security, and it helps in avoiding future costs incurred, like through bug bounties or breaches or pen testing.
While prioritizing threat modeling areas, instead of boiling the ocean, focus on the most important assets, the critical assets, and their exploitability.
Security should always be a joint collaboration between the execs and the engineers. Execs need to influence and support the engineers so that they can build a strong security system.
Train your engineers on threat modeling and ask security questions. It helps in building a strong security foundation.

Vulnerability management deep dive with Walter Haydock

Fri, 14 Apr 2023 00:00:00 GMT

Walter Haydock argues that the Exploit Prediction Scoring System (EPSS) offers a data-driven way to prioritise vulnerabilities by the probability they will actually be exploited. He recommends documenting the process, designing playbooks for patches and updates, and defining thresholds and actions for identified vulnerabilities. There is no one-size-fits-all approach — the starting point is understanding your asset inventory and its exploitability.

Exploit prediction scoring system which is also known as EPSs is a better way to understand and prioritize vulnerabilities as it uses data driven approach to determine the likelihood or probability of a vulnerability to be exploited.
As part of vulnerability management programs document the process design playbooks for like patches and updates and define thresholds and actions for the identified vulnerabilities to prioritize vulnerability actions.
There is no one size fits all approach. Instead understand your asset inventory and its exploitability.

Into the Dark Web with Brett Johnson

Fri, 07 Apr 2023 00:00:00 GMT

Brett Johnson warns that credential stuffing is a massive problem and that attackers have already found workarounds to MFA through techniques like evil proxy — hardware keys are his recommendation. He urges organisations to understand their exposure and cybercrime value: what an attacker gains by targeting them. Humans are the key link because they are wired to trust, making them prime targets for social engineering.

Credential Stuffing is a massive problem. Attackers have already found workarounds to MFA with techniques like Evil Proxy. Use of Hardware keys is recommended.
Understand your exposure and cyber crime value. Cyber crime value is what can an attacker benefit by attacking you or your organization.
Humans are the key link in Data Privacy issues. Because, humans are by default designed to trust and that’s what makes them target of Social Engineering or Phishing attacks. Train your team and conduct frequent table top or fire drill exercises to evaluate preparedness.
Culture is important. Open & engaging environment is a key factor in building a healthy & solid cyber security hygiene in an organization.

Dealing with Social Engineering Attacks with Emily Zakkak

Fri, 24 Mar 2023 00:00:00 GMT

Emily Zakkak stresses that an incident-response plan is a must for fighting phishing and social engineering attacks. Security awareness is the responsibility of the entire organisation, not just the security team. Wherever possible, MFA should be implemented across applications and implicit trust eliminated to limit the blast radius of breaches.

Incident Response Plan is a must in order to fight phishing or social engineering attacks.
Security is the responsibility of the entire and not just of the security team to bring awareness. Security awareness training should be conducted with other teams in the organization.
Whenever possible, implement MFA across applications and avoid implicit trust across applications. This would help in avoiding large scale data breaches.

Blue Team And Digital Forensics with Karan Dwivedi

Fri, 17 Mar 2023 00:00:00 GMT

Karan Dwivedi argues that deep understanding of the threat model is essential for blue-team success. He sees red teams as partners rather than adversaries in improving defence programmes. Forensic data accuracy should never be sacrificed for speed — compromised evidence undermines the entire analysis.

Understanding the threat model in depth is very important for Blue Team to be successful.
Red Team should be considered as partners rather than adversaries in building and improving the threat defense program.
Accuracy of digital forensic data is key for analyzing and improving security difference programs. It should not be compromised in order to move fast.

Discussing GRC and Data Privacy With Alyssa Ahmann

Fri, 10 Mar 2023 00:00:00 GMT

Alyssa Ahmann argues that the first step in building a solid security programme is understanding the scope and current setup thoroughly. Documentation and organisational training are essential for a successful GRC practice. Data privacy, in her view, has no one-size-fits-all approach — it depends on industry, geography, and regulations.

The very first step in setting up a solid security program is to understand the scope and the current set up really well.
Documentation of the security process and organizational training are super important for the successful GRC setup.
When it comes to data privacy, there is no one size fits all approach. It always depends on various factors like industry, geography, regulations and anymore.

AWS Security And Monitoring With Rodrigo Montoro

Mon, 06 Mar 2023 00:00:00 GMT

Rodrigo Montoro argues that cloud practitioners should threat-model every new AWS service to understand attack paths and set the right permissions. He advises restricting high-impact write permissions using IAM conditions like source-IP and VPN constraints. He also recommends disabling IMDSv1 via SCP to prevent credential theft.

Before using any new service or thinking about any new service, thinking about security for any new service cloud practitioners should do threat modeling exercise to understand the attack paths because that helps in defining the right set of permissions policies for the service.
Limit impact of any attacks always apply restrictions on high impact permissions like write or put permissions in the im policies and for that you can use conditional clause like conditions clause where you can restrict it to a vpn ips or your particular ips or IP certs.
For IMDSV one vulnerability define policies in scp to disable creation of any new EC. Two instances with imds v one enabled

Learning Red, Blue, and Purple Team With Paul Dyer

Fri, 24 Feb 2023 00:00:00 GMT

Paul Dyer recommends that before investing in red or purple teaming, organisations should understand their threat landscape, security maturity, and detection capabilities. Certifications like SOC 2 or HIPAA provide a foundation, but continuous risk assessment is where lasting value lies. For open-source usage, he stresses SBOMs, regular security assessments, and evaluating alternatives when better options exist.

For organizations before investing in threat hunting or Red teaming, blue teaming or Purple teaming, understand your threat landscape, your security maturity, and have threat detection capabilities via different tooling.
Certifications like soc. Two hipaa, et cetera are a good foundation, but invest in continuous security risk assessment.
For open source usage and security of it. Invest in understanding software, bill of materials like the spawns, and perform regular security assessment and look for alternate solutions wherever necessary, wherever there are better security options available.

Understanding Kubernetes and Governance With Jim Bugwadia

Fri, 17 Feb 2023 00:00:00 GMT

Jim Bugwadia explains that in managed Kubernetes, hyperscalers handle the control plane, but workload and worker-node security remain the user's responsibility. He recommends implementing resource quotas, resource limits, image signing, and CVE scanning for ingress controllers. Sigstore's keyless signature approach using manifests is worth evaluating for workload protection.

For managed kubernetes hyper scalers are sort of responsible for control plane, key value store like, etc. But when it comes to security of the workloads or worker notes, it’s the user’s responsibility.
In case of Kubernetes, like securing. Kubernetes best practice is to implement a few poor security policies like resource quotas, resource limits, signing of images and checking for CVS for the ingress controllers.
To avoid attack on workload security. One of the measure is to use image signing and Sigstore offers a keyless signature approach using the manifest. It should be taken a look at.

Prepare , Plan and Budget Organizational Security with Nader Zaveri

Fri, 10 Feb 2023 00:00:00 GMT

Nader Zaveri argues that incident-response preparation means defining a plan, socialising it across the organisation, and running tabletop or fire-drill exercises to test readiness. To defend against social engineering and doxing, he treats MFA as a must and recommends layering one-time-passcode or hardware- key authentication on top. Building a security-centric culture, in his view, rests on the idea that security is everyone's responsibility and that accountability is key.

For incident response. Always prepare a plan and socialize that within the organization and perform tabletop or fire drill exercises to check for the preparedness of those.
Avoid social engineering and doxing attacks. MFA is a must. And on top of that, use onetime passcode based or the hardware keybased authentication to improve the security even further.
Security is everyone’s responsibility and accountability is one of the key areas to building a security centric culture.

Data Privacy And Governance With Adam Smith

Fri, 03 Feb 2023 00:00:00 GMT

Adam Smith advocates for personal-data inventories and data-flow maps so teams understand how sensitive data moves through the organisation. For governance, he stresses the importance of cataloguing and building a knowledge base to improve visibility. Recognition — even simple shout-outs or pins — is an effective way to nurture a privacy-first culture.

Prepare personal data inventory data flow maps for teams to understand how data, particularly crown jewels, are being referred and used or should be used throughout the organization.
For data governance, cataloging is important. Build a knowledge base to improve visibility and awareness of the governance process.
Recognition is an important part of building a security or privacy first culture. It can be as simple as shoutouts or stickers or pins.

Kubernetes Security And Misconfigurations With Jimmy Mesta

Fri, 27 Jan 2023 00:00:00 GMT

Jimmy Mesta explains that the shared-responsibility model covers the control plane but leaves workload secrets, base images, RBAC, and logging to the user. Kubernetes misconfiguration checks should be continuous, not one-time, covering manifests, CI/CD pipelines, and runtimes against CIS benchmarks or the NSA hardening guide. Self-hosting brings significant operational and security challenges, so managed offerings are preferable where possible.

As part of the shared responsibility model, cloud providers take care of a few areas like the control plane or data HCD, key value store and stuff like that. But there are areas like your own workload secrets, base images. There is RBAC dashboard and logs, which users need to be careful about. So that is the first one.
Kubernetes misconfig checks should be a continuous process instead of a one time scan and done type of thing. There are many areas when it comes to misconfig like your manifest, your CI/CD pipeline, mission controls, run times, etc. So focus on coverage using the CIS benchmarks or NSA hardening guide or OWASP Top 10.
With self-hosting. There are many operational and security challenges that come with it. Cloud providers are good at abstracting these security aspects from a managed perspective. For the managed pieces, if possible, avoid self-hosting and use a cloud managed K8s offering.
For Kubernetes Security instead of just relying on open source understand Kubernetes and Kubernetes Security Security in details, follow a threat modeling based approach rather than a checklist based approach.

Network Perimeter Security With Syeed Shareef

Fri, 20 Jan 2023 00:00:00 GMT

Syed Shareef explains that AWS data perimeters combine SCPs, resource policies, identity policies, and network policies to build a perimeter around data. He recommends addressing all areas — identity, network, and resource — when defining perimeter policies. Security should focus on use cases rather than the latest tools, because technology is a means to an end.

Data Perimeter provides additional security capabilities on top of current AWS offerings by combining power from SCP, Resource Policies, Identity Policies, Network Policies, etc. to build a perimeter around your data.
It’s recommended to focus on all the areas of Data Perimeter like Identity, Network & Resource while defining policies.
When it comes to Security focus should be on Use cases and not on the latest and greatest tools. Technology is means to an end and not an end in itself.

Focusing On Cloud Vulnerability With Ray Espinoza

Fri, 16 Dec 2022 00:00:00 GMT

Ray Espinoza argues that improving security culture starts with empathy — understanding existing processes before introducing new ones. Continuous learning and engagement are essential for better collaboration between security and other teams. During incidents like phishing or zero-day exploits, staying calm and communicating transparently is critical for all stakeholders.

To build and improve security culture in an organization, lead with empathy. Understand current culture and processes before introducing new ones.
Alignment is a key factor in improving collaboration between the security team and other teams in an organization. Continuous learning and engagement is a must.
In case of an incident like, let’s say, phishing attack or zero-day vulnerability. It’s utmost important to be calm. Transparent communication is critical for internal and external stakeholders.

Measuring Security Debt With Garrett Smiley

Tue, 06 Dec 2022 00:00:00 GMT

Garrett Smiley argues that security-debt priority is always context-driven — organisations should re-evaluate risks based on liability and exploitability. Building a security culture depends on clear messaging from leadership and team motivation. He suggests replacing KPIs with KRIs (key risk indicators) as a more realistic measure of a security team's effectiveness.

Priority of security debt is always context driven. Businesses should reevaluate the risks depending on liability or exploitability of it and how it applies to the business.
Building a security centric culture always depends on two aspects. First is the messaging from the leadership of the execs. And the other one is how motivated the team is, how motivated the team is in general.
KPIs may not be the best metric to determine success of security team members. The more realistic metric could be Kri, where R stands for risk.

Mastering Organizational Security Culture with Trupti Shiralkar

Fri, 18 Nov 2022 00:00:00 GMT

Trupti Shiralkar recommends building security awareness through focused sessions like brown bags or lunch-and-learns on topics such as XSS or cryptojacking. For managing security debt, she advocates joint backlog reviews between engineering and security rather than separate discussions. Supply-chain security requires defining standards for open-source components and tooling to evaluate them.

To build a security centric culture, first educate other teams about security roadmap & improve security awareness. It can be as simple as Brown Bags or Lunch & Learns focused on specific Security Areas like XSS or Cryptojacking.
In order to prioritize & address security debt, have a combined Backlog Review discussion between Engineering & Security teams. Instead of separate discussions.
To work with today’s Supply Chain Security challenges, define & follow standards for Open Source components & have tooling in place to evaluate these components.
For Risk Management, focus on Thread Modeling & Threat Agents for quantification & prioritization of Security Risks.

Setting the Line of Defence in Cloud Security with Charles Mendoza

Fri, 04 Nov 2022 00:00:00 GMT

Charles Mendoza argues for a layered approach to cloud defence, combining preventive, detective, and corrective controls. He discusses how to set clear lines of defence that match the organisation's risk appetite. Incident-response readiness — knowing who does what before an event occurs — is a recurring theme in his advice.

Measure your current risk posture using existing tools. This helps in justification of the spend and budget planning.
Data privacy is a shared responsibility across all members in the organization. It’s not a tools problem.
MFA should be set up for all the apps and services as a first line of defense. It’s the basic security that we should all adhere to.

Security debt and prioritizing risks with Aakash Yadav

Fri, 21 Oct 2022 00:00:00 GMT

Aakash Yadav argues that security debt must be prioritised alongside other engineering work, using risk impact and exploitability as the primary drivers. He advocates a pragmatic approach: fix what matters most first and build a continuous process for reducing risk over time. Communication with stakeholders about what is being deferred and why is essential.

Security program should be risk driven rather than compliance driven. So risk assessment is the key for designing a good security program.
Continued reevaluation of the risks in your risk matrix is the key to prioritization. It also helps in addressing security depth.
Prior to using any open source software, do a security review in terms of support from the contributors. How big is the community release frequency and how engaged is the community for that open source software?

Understanding Information Security and Risk Management With Parul Khanna

Fri, 07 Oct 2022 00:00:00 GMT

Parul Khanna draws on her background in incident response, cybersecurity investigations, and software engineering to discuss practical risk management. She argues that bridging the gap between security operations and business priorities requires clear communication and stakeholder alignment. Her advice covers programme design, certification strategy, and building resilience.

For risk management, have security baked in early in your SDLC process. This helps in your security debt prioritization as well.
Follow the Information Security triad, which is also known as CIA Triad. The confidentiality, integrity and availability. For Data Protection and Cyber security, apply the NIST framework for identification, detection and analysis of your critical assets.
To avoid phishing, social engineering or even doxing attacks. Follow the basics of security properly, like use of a multifactor authentication or use of strong passwords and use VPN at minimum.

Big Mistakes in Cybersecurity With Mel Reyes

Fri, 30 Sep 2022 00:00:00 GMT

Mel Reyes argues that security should be mandated top-down but implemented in partnership with the individual contributors who own the systems. He advises starting small with frameworks like NIST or CIS, understanding risk tolerance, and performing gap analysis along the way. For startups, he recommends working with advisory boards or VC security groups if dedicated hiring is not yet feasible.

Security should be mandated from top down and it should be implemented in partnership with individual contributors or the doors, right? Who own the implementation.
From a security standpoint, start small with frameworks like Nest, CIS, sock one and understand your risk tolerance. Do the gap analysis during the process as well.
For startups. Start early if hiring insecurity is a challenge, working with partners or VCs groups or security like advisory boards or cloud advisory groups to set up a solid foundation.

Part 2 - Zero Trust Architecture With Vincent Romney

Fri, 23 Sep 2022 00:00:00 GMT

Vincent Romney recommends understanding your current architecture first and then introducing zero trust layer by layer, following the NIST 800-207 guidelines closely. He frames security debt as tech debt for security and stresses clear communication with leadership to balance business growth against risk reduction. When working with executives, he tailors the message and adds context to make the risk and infrastructure challenges concrete.

To implement Zero Trust as part of the security program, understand the current Architecture first and then introduce Zero Trust in each layer one by one. Follow the NIST 800-207 guidelines closely.
Security debt is nothing but Tech Debt for Security. Have clear communication with Leadership team to find a balance between business growth and reducing the risk.
When working with Executives, tailor the message & add context to show the Risk and challenges in the security infrastructure.

Zero Trust Architecture With Vincent Romney

Thu, 15 Sep 2022 00:00:00 GMT

Vincent Romney argues that the CIS Benchmarks 1 and 2 are the most important starting point for zero trust, beginning with drawing and understanding the inventory architecture. Identity is a core component that feeds into zero trust — he recommends defining and enforcing policies to extend zero trust across the infrastructure. MFA is a must, and he favours hardware-based options like YubiKey as the strongest choice.

For Zero Trust CIS 1 & 2 Benchmarks are the most important. To start, Draw & Understand the Inventory architecture.
Identity is one of the core components of Zero Trust and it feeds into Zero Trust. Define the Policies and enforce the policies to incorporate zero trust through out the infra.
MFA is a must in today’s world. Hardware Device based MFAs like YubiKey are the best options.

Preparing For Potential Cloud Data Breaches With Nat Shere

Fri, 02 Sep 2022 00:00:00 GMT

Nat Shere argues that breach preparation must cover both business risk and financial impact, backed by an incident response plan and frequent simulations. When communicating security needs to executives, he recommends tailored messaging that resonates with each audience. The two metrics every security team should track are mean time to detect and mean time to recover.

When it comes to Preparation for data breaches or ransomware attacks, focus on both Business Risk & Financial Impact. Have an Incident Response Plan & Perform frequent simulations with all the stakeholders to check your preparedness.
When working with other Teams & Executives, use Tailored Messaging to educate & bring consensus on the Security needs for the organization.
There are 2 Key metrics which every security team should follow. First, keep lower MTTD (Mean time to Detect) and lower MTTR (Mean time to Recovery).

Cloud Security Planning With An Ethical Hacker Aseem Shrey

Wed, 24 Aug 2022 00:00:00 GMT

Aseem Shrey argues that organizations should acknowledge and build trust with ethical hackers who report findings, rather than ignoring them. He advises security leaders to use data-driven metrics and clear objectives when budgeting for breach preparedness. For those starting in security, he recommends getting hands-on experience across multiple areas before specializing.

When a hacker reports a finding. We sometimes ignore it. It’s not wise to do so. Instead, Acknowledge and work with the Hackers to improve your Security Posture.
In order to prepare an organization for potential data breaches or attacks, use a Data Driven approach and define clear Objectives.
When starting your career in Security, always start small and get your hands dirty in various areas of Security. This will help you in finding the right path for your career.

Solutions To Roadblocks In Cloud Security With Chris Neggel

Mon, 08 Aug 2022 00:00:00 GMT

Chris Neggel draws on his experience at Okta and LinkedIn to identify the most common roadblocks in cloud security — from misaligned incentives to organisational silos. He shares practical strategies for overcoming these barriers, including building customer trust, thought leadership, and cross- functional collaboration.

Security is not just a checkbox. Certifications should be used as a measurement tool rather than a goal. Continuous security improvement has much more impact than just getting certifications like SOC2, ISO, HIPAA, etc.
In order to setup IAM in the most accurate way, understanding Who needs access to What, When and Why are the most important factors. IT should enable teams to own IAM rather than becoming the roadblock. For a quick win, enforce MFA at minimum.
In terms of data breaches or attacks, every incident is different. So, focus more on defining a solid Incident Response Program and Organization chain of command rather than specific tactics.

Cloud Security Reviewed With Ski

Fri, 29 Jul 2022 00:00:00 GMT

Ski argues that transparency, executive support, and regular training are the pillars of a security-centric culture. To improve working relationships with other teams, security should engage early and define a go-to-market security strategy collaboratively. Certifications become easier when the underlying controls and baselines are already properly set and monitored.

To build a security centric culture, Transparency with teams, getting Executive Support and Investing in Regular Training are utmost important.
In order to improve working relationships with other teams, Security Teams should Start interacting early in the journey and define Go To Market Security Strategy along with the teams.
Regarding Certifications, always start with security controls. Set the proper controls, baselines and have frequent monitoring in place. Align it with the Vision of the organization. Certification would be easier if controls are defined properly.

Best Approach To Cloud Security With Gary Dylina

Fri, 24 Jun 2022 00:00:00 GMT

Gary Dylina advises security teams to provision for expected load with safety margin, scan for vulnerabilities, and run penetration tests before large-scale events. He explains that SOC2 and ISO certifications build customer trust, but some customers will want deeper proof of your security posture. On IAM, he recommends SSO, MFA, and role-based access controls with periodic reviews, and suggests the right time for a first security hire depends on the existing team's capabilities. Gary Dylina advises security teams to provision for expected load with safety margin, scan for vulnerabilities, and run penetration tests before large-scale events. He explains that SOC2 and ISO certifications build customer trust, but some customers will want deeper proof of your security posture. On IAM, he recommends SSO, MFA, and role-based access controls with periodic reviews, and suggests the right time for a first security hire depends on the existing team's capabilities.

Bizzare Cloud Security Facts With Gaurav Batra

Fri, 24 Jun 2022 00:00:00 GMT

Gaurav Batra shares lesser-known cloud security insights and discusses what organisations get wrong when securing their cloud environments. He emphasises the importance of cross-training and building a security-centric mindset across teams, drawing on his experience at Mondelez International and as founder of CyberFrat.

Cloud Security Made Simple With Swati Anuj Arya

Fri, 24 Jun 2022 00:00:00 GMT

Swati Anuj Arya explains that in a confirmed data breach the first step is identifying whether regulated data was impacted and who must be notified within the legal timeline. Containment is critical — the breach should not ripple into other systems. A thorough root-cause analysis drives both short- term and long-term fixes and satisfies regulators.

Understanding Cyber Security With Aseem Rastogi

Fri, 17 Jun 2022 00:00:00 GMT

Aseem Rastogi shares his experience leading cybersecurity and compliance at both Razorpay and Meesho. He discusses the challenges of building a programme from scratch, earning stakeholder trust, and creating a culture where security is everyone's responsibility. His practical advice covers prioritisation, tooling, and aligning security with fast-moving product teams.