Pursuing perfect solutions is a perfect waste From Chapter 6 - How to Scope, Size, and Start Zero Trust (Page 78) of www.amazon.com/Zero-Trust-O... 🧵

Security is often incorrectly perceived as a 'technical problem' that can be 'solved' (it isn't!) by business leaders. *Security is an ongoing risk that requires ongoing work.* This misperception is often accidentally created or reinforced by the security team. 🧵

I just posted my slides from my talk on Zero Trust and AI Security at The Official Cybersecurity Summit in Tampa. Slides here - www.slideshare.net/slideshow/ai... Some photos from the event here - www.linkedin.com/posts/jan-br... Share and Enjoy!

I have come to appreciate that expectations for GenAI models (language models and similar) are often wrong. The technology is extremely powerful and impressive, but it is not like anything we have experienced or imagined as humans so we have to adjust our expectations a 🧵

I am finalizing this new data security diagram for the next version of the MCRA (aka.ms/MCRA) What do you all think? FYI, we first developed this for the Data Security workshop from Microsoft Unified (aka.ms/SAF)

Building and securing AI apps/agents is VERY different than classic apps. Instead of just asking "What did we BUILD into the app" -- we must also ask "How well did we CONSTRAIN the model?" 🧵

An Agile Roadmap One of the most critical elements of a strategy is a roadmap that lays out how to achieve that business vision. In today’s world of constant change, that roadmap must be agile so that it can be adapted and changed as you learn. 🧵

Design security policies to create a healthy level of friction Policies should be designed to set a productive and helpful level of “security friction” in business and technology processes. 🧵

Enable good security decisions by everyone in the organization 🧵

I am working on a new diagram for describing SecOps roles and how they fit into the operating model (aka teams/tier model) - thoughts? feedback?

What is agile security? Agile security is simply acknowledging that the real world is messy and unpredictable, and adapting to that. Zero Trust enables an agile approach to security. 🧵

🔷 If you reward business leaders to ignore cybersecurity, they will. 🔷 If you reward technology teams to ignore cybersecurity, they will. 🔷 If you think security teams can magically stop criminals and spies while this is happening, you are fooling yourself.

Never confuse accountability with responsibility. From the Security Roles and Glossary standard Part 2 : Section 4.4 🔷 Download the Standard - publications.opengroup.org/s252 🔷 Read the Article - www.linkedin.com/pulse/securi... 🧵

These may not be the droids... errr jobs that you are looking for. A lot of people mistake manager or leadership jobs for "technical person in charge" This slide is from a career talk I gave recently.

Always ruthlessly prioritize Regardless of the size of your Zero Trust efforts, you should always rigorously and intensely prioritize your effort, ensuring you are continually focused on driving quick wins and incremental progress.

Every place an IT admin enters or stores their credentials is a potential place for them to be stolen and abused for ransomware, data theft, and more. For guidance on how to secure privileged access, see aka.ms/SPA

Protecting people and society is why people _should_ care about cybersecurity, but fiduciary duty is why organizational leaders _must_ care about it. (short 🧵 with download link for an open standard at the end)

I just posted slides from my sessions at The Open Group conference last month. This includes slides from two sessions: ◼️ Security and Zero Trust Body of Knowledge Introduction and Overview ◼️ Security Roles and Glossary Standard Overview and Vision www.slideshare.net/slideshow/se... 🧵

Pursuing perfect security is a delusion The greatest obstacle to security success is assuming and expecting that perfect security is possible (or worthwhile to pursue). (1 of 2)

Security budget getting cut because you made progress? Worried the problems will come back as soon as you stop investing in security? You're probably right... a 🧵

If you reward technology teams to ignore cybersecurity, they will. If you think security teams can magically stop criminals and spies while this is happening, you are fooling yourself.

An organization can never be resilient until they stop rewarding "blame the scapegoat” behavior and start making people accountable for their actions and decisions. 🔷 If you reward business leaders to ignore cybersecurity, they will. ... a 🧵

This was one of my favorite slide sequences to create, partially because it allowed me to use one of my favorite games to illustrate important cybersecurity points. (and yes, there are animations and morph transitions in the downloadable slides - aka.ms/mcra) 🧵

Are you signing up for a 2 breach minimum? That's what often happens when you don't logs for security: a 🧵

Cybersecurity is part of EVERYONE’S Job Cybersecurity professionals are currently and always will be set up to fail (and blamed for those failures) UNLESS security accountability and responsibility are correctly assigned across business, technology, and security roles a 🧵

How can CISOs move from "Chief Incident Scapegoat Officer" to "key business partner who keeps me out of jail and keeps our assets safe"? How to become a trusted advisor instead of being sent to the kids table & ignored while waiting to be blamed/fired at the next incident? a 🧵

Is your access management strategy fragmented to the point where it only helps attackers and frustrates everyone in your organization? a short 🧵

AI is different. Building and securing AI Agents is fundamentally different - they are the programs/applications/apps of the AI platform, but managing risk from them is fundamentally different than previous apps because they come with so much functionality.

Looking for a list of cybersecurity roles and responsibilities? Check out the Security Roles and Glossary Standard we just published. www.linkedin.com/pulse/securi...

Episode #121 is out! We turn the tables and speak to @markasimos.bsky.social about new material from The Open Group. It's a long episode but worth it! Also, the news!

I recently put together this summary of how AI impacts different disciplines in security. Thoughts? Feedback? Anything I missed?

The Open Group just published a Security Roles and Glossary standard defining security responsibilities and accountabilities. publications.opengroup.org/s252 publications.opengroup.org/s253 publications.opengroup.org/s254 publications.opengroup.org/s255 short 🧵with key points...

The Microsoft Ignite Book of News is released. I highly recommend taking a quick look through it as there is a lot of security news and releases (keyword search had 172 hits on the word security 🙂) news.microsoft.com/ignite-2025-...

I am working on a new antipattern that is a real pet peeve of mine. I pretty much stop listening after I hear "This attack would have been stopped by..." short 🧵(rant)

Security teams cannot operate in isolation and CISOs should not be the only roles who talk to business leaders and other teams. Most people in a security team should be interacting with non-security people across technology and business teams.

I found myself using this career advice slide a lot lately and thought I would share it more broadly.

We were tempted to add this to the security glossary definitions, but we reluctantly decided to take it out (see? standards people have a sense of humor as well 😀) For more on roles and glossary standard (and others in this body of knowledge), see lnkd.in/gyd-3T39

Attackers want, cheap, easy, and reliable access to your assets. The job of defenders is to take those away from them. Everything in security is about removing the cheap, easy, and reliable options from the threat actor menu.

We spent some time working on security capabilities for the next revision of the Zero Trust Reference Model standard at The Open Group conference short 🧵 with some updates and insights

One thing that has been bugging me about this whole "AI replacing jobs" topic is that the discussion is too sloppy to reach a meaningful understanding or conclusion. This post is a bit pedantic, but I have a reason for the details so bear with me :-) a 🧵

On Monday in Houston, I am presenting the Security and Zero Trust body of knowledge + first release of the new Security Roles and Glossary standard. I will post slides afterward, but sharing this sneak peek of the session with the overarching goals of the standards in this body of knowledge

We’re working on updating the disciplines of the Microsoft Security Adoption Framework (SAF) and wanted to get your feedback Current guidance is on aka.ms/SAF a 🧵

I will be speaking in person in Houston at The Open Group Event in Houston next week! We will be formally announcing some new security standards and hope to see you there! meet.opengroup.org/event/Housto...

Security Posture Management is often the forgotten discipline in the cybersecurity profession. a 🧵

Security success is attacker failure, but we can never guarantee that we can stop every attack. Because you will inevitably experience damage from successful cybersecurity attacks, its critical to focus on building resilience by ensuring that you can:

I spend many of my working hours building workshops (MCRA, CISO Workshop, and others in the SAF) to help organizations guide their security modernization journey with learnings and best practices from Microsoft and our customers.

Should IT teams let security professionals patch and reboot your servers anytime they want? Should security professionals be able to update your code and deploy it anytime they want?

One type of role really stood out from all of the others as we standardized security responsibilities and accountabilities across all roles in an organization. The Information Worker/Frontline Worker (marked with a star) is the heart and core of the organization rant/🧵

Security success is attacker failure, but we can never guarantee that we can stop every attack. Because you will inevitably experience damage from successful cybersecurity attacks, its critical to focus on building resilience by ensuring that you can: (1/2)

I recently created this graphic on how securing AI is different from classic (deterministic) code. Thoughts? Feedback?