The SAF documentation site and June 2026 MCRA just went live on Microsoft Learn! Check it out and let us know what you think! aka.ms/SAF Note: This is the first release and we will be continuing to add to it. Send us your feedback, requests, and ideas.

Hey y'all I just recorded my first video in my new 'Mark on Cybersecurity' YouTube channel! Lots more to come! Let me know what you think and what topics you would like me to cover youtu.be/gKRWhAFQk4Y

I keep hearing people are "Automating Tier 1 with AI" (or some other job) and I think words really matter here. ◾ Are you trying to replace a human person with AI? Assigning a human role to AI? ◾ Are you automating the tasks currently being done by people? a short 🧵

Security can never “win the game” - it's not the job we signed up for. We are the defense squad so we don't score goals or points - we just keep opponents from scoring points.

One of the most critical skillsets for CISOs is their ability to navigate the power structure of an organization (e.g. politics) I included this slide in my recent Tampa BSides talk (slides posted, recording pending) - zerotrustplaybook.com/events/ 🧵

Understanding and using the Why/What/How Chain is critical for everyone in security. I covered this in my Tampa BSides talk. Link to download the slides (and other past slides) here - zerotrustplaybook.com/events/ 🧵

I just posted the slides for my 'Security is a Team Sport (but we are NOT playing like a team)' session at BSides Tampa Check out the Events page for the link to those slides as well as videos/slides from previous talks. zerotrustplaybook.com/events/

Just putting the finishing touches on slides for my BSides Tampa talk "Security is a Team Sport ... but we are NOT playing as a team" Hope to see you there on Saturday!

"Somebody should do this" means "Nobody will do this" unless you assign a name.

I just posted the slides for my BSides South Florida talk on the events page zerotrustplaybook.com/events/

I recently did an interview-style session for an internal Microsoft team on why end to end security is so important and thought I would share my notes on the points to cover. 🧵

Each day is life www.linkedin.com/pulse/each-d...

The Zero Trust Playbook site is live! It currently has a summary of the series, the outline of the first book, some information on the authors, and an events page with upcoming events and recordings. Much more to come in time!

The full length video has been posted for the announcement of the security roles and glossary standard! ◾ Video - www.youtube.com/watch?v=bMRr... ◾ Slides - www.slideshare.net/slideshow/se...

Are the people in your organization rewarded to ignore security?

One of the statements that really stuck with me from this episode was around the 'advanced persistent threat' terminology. Paraphrasing - the persistence is more important to attacker success than the advanced. I definitely recommend listening thecyberwire.com/podcasts/aft...

The full length video has been posted for the Security and Zero Trust body of knowledge session! www.youtube.com/watch?v=WaF6...

AI Inherits speed and scale from the GPUs it runs on, but it inherits unpredictability from the (social) human data it was trained on. a short 🧵

What does a CEO need to know about cybersecurity? See the (draft) Security Roles and Glossary standard for what knowledge, skills, & abilities are required of CEOs, board members, and other leaders (as well as accountabilities, fiduciary duty, & more). publications.opengroup.org/s252

Cybersecurity is often incorrectly seen as a 'technical problem' that can be 'solved' (it isn't!) by business leaders & others. *Security is an ongoing risk that requires ongoing work.* Security leaders often accidentally create or reinforce this misperception. a short 🧵

Think security can do it all on our own? WRONG! We must recognize that we are part of a larger team and each of us has a different part to play in protecting the organization. short 🧵

Want to lead Zero Trust marketing at Microsoft? apply.careers.microsoft.com/careers/job/...

The video for my 'What's my job again' talk from BSides Tampa has posted Video - www.youtube.com/watch?v=uVAA... Slides - www.slideshare.net/slideshow/wh... Roles standard - publications.opengroup.org/s252

Ever been tempted to call people "stupid users" because they make a basic security or technology mistake? I would advise against saying this and encourage you to change your thinking patterns. A short 🧵

I recently realized that the 'autonomous SOC' idea is the same old snake oil packaged up with a fancier and more intellectual-sounding name The 'technology can prevent attacks / stop breaches' claim that has been disproven over and over (similar to compliance claims) a 🧵

I am excited to talk about one of my favorite topics at BSides Tampa on May 16! *Security is a team sport (and we are NOT playing like a team)*

Pursuing perfect solutions is a perfect waste From Chapter 6 - How to Scope, Size, and Start Zero Trust (Page 78) of www.amazon.com/Zero-Trust-O... 🧵

Security is often incorrectly perceived as a 'technical problem' that can be 'solved' (it isn't!) by business leaders. *Security is an ongoing risk that requires ongoing work.* This misperception is often accidentally created or reinforced by the security team. 🧵

I just posted my slides from my talk on Zero Trust and AI Security at The Official Cybersecurity Summit in Tampa. Slides here - www.slideshare.net/slideshow/ai... Some photos from the event here - www.linkedin.com/posts/jan-br... Share and Enjoy!

I have come to appreciate that expectations for GenAI models (language models and similar) are often wrong. The technology is extremely powerful and impressive, but it is not like anything we have experienced or imagined as humans so we have to adjust our expectations a 🧵

I am finalizing this new data security diagram for the next version of the MCRA (aka.ms/MCRA) What do you all think? FYI, we first developed this for the Data Security workshop from Microsoft Unified (aka.ms/SAF)

Building and securing AI apps/agents is VERY different than classic apps. Instead of just asking "What did we BUILD into the app" -- we must also ask "How well did we CONSTRAIN the model?" 🧵

An Agile Roadmap One of the most critical elements of a strategy is a roadmap that lays out how to achieve that business vision. In today’s world of constant change, that roadmap must be agile so that it can be adapted and changed as you learn. 🧵

Design security policies to create a healthy level of friction Policies should be designed to set a productive and helpful level of “security friction” in business and technology processes. 🧵

Enable good security decisions by everyone in the organization 🧵

I am working on a new diagram for describing SecOps roles and how they fit into the operating model (aka teams/tier model) - thoughts? feedback?

What is agile security? Agile security is simply acknowledging that the real world is messy and unpredictable, and adapting to that. Zero Trust enables an agile approach to security. 🧵

🔷 If you reward business leaders to ignore cybersecurity, they will. 🔷 If you reward technology teams to ignore cybersecurity, they will. 🔷 If you think security teams can magically stop criminals and spies while this is happening, you are fooling yourself.

Never confuse accountability with responsibility. From the Security Roles and Glossary standard Part 2 : Section 4.4 🔷 Download the Standard - publications.opengroup.org/s252 🔷 Read the Article - www.linkedin.com/pulse/securi... 🧵

These may not be the droids... errr jobs that you are looking for. A lot of people mistake manager or leadership jobs for "technical person in charge" This slide is from a career talk I gave recently.

Always ruthlessly prioritize Regardless of the size of your Zero Trust efforts, you should always rigorously and intensely prioritize your effort, ensuring you are continually focused on driving quick wins and incremental progress.

Every place an IT admin enters or stores their credentials is a potential place for them to be stolen and abused for ransomware, data theft, and more. For guidance on how to secure privileged access, see aka.ms/SPA

Protecting people and society is why people _should_ care about cybersecurity, but fiduciary duty is why organizational leaders _must_ care about it. (short 🧵 with download link for an open standard at the end)

I just posted slides from my sessions at The Open Group conference last month. This includes slides from two sessions: ◼️ Security and Zero Trust Body of Knowledge Introduction and Overview ◼️ Security Roles and Glossary Standard Overview and Vision www.slideshare.net/slideshow/se... 🧵

Pursuing perfect security is a delusion The greatest obstacle to security success is assuming and expecting that perfect security is possible (or worthwhile to pursue). (1 of 2)

Security budget getting cut because you made progress? Worried the problems will come back as soon as you stop investing in security? You're probably right... a 🧵

If you reward technology teams to ignore cybersecurity, they will. If you think security teams can magically stop criminals and spies while this is happening, you are fooling yourself.

An organization can never be resilient until they stop rewarding "blame the scapegoat” behavior and start making people accountable for their actions and decisions. 🔷 If you reward business leaders to ignore cybersecurity, they will. ... a 🧵

This was one of my favorite slide sequences to create, partially because it allowed me to use one of my favorite games to illustrate important cybersecurity points. (and yes, there are animations and morph transitions in the downloadable slides - aka.ms/mcra) 🧵

Are you signing up for a 2 breach minimum? That's what often happens when you don't logs for security: a 🧵