One of the statements that really stuck with me from this episode was around the 'advanced persistent threat' terminology. Paraphrasing - the persistence is more important to attacker success than the advanced. I definitely recommend listening thecyberwire.com/podcasts/aft...

The full length video has been posted for the Security and Zero Trust body of knowledge session! www.youtube.com/watch?v=WaF6...

AI Inherits speed and scale from the GPUs it runs on, but it inherits unpredictability from the (social) human data it was trained on. a short 🧵

What does a CEO need to know about cybersecurity? See the (draft) Security Roles and Glossary standard for what knowledge, skills, & abilities are required of CEOs, board members, and other leaders (as well as accountabilities, fiduciary duty, & more). publications.opengroup.org/s252

Cybersecurity is often incorrectly seen as a 'technical problem' that can be 'solved' (it isn't!) by business leaders & others. *Security is an ongoing risk that requires ongoing work.* Security leaders often accidentally create or reinforce this misperception. a short 🧵

Think security can do it all on our own? WRONG! We must recognize that we are part of a larger team and each of us has a different part to play in protecting the organization. short 🧵

Want to lead Zero Trust marketing at Microsoft? apply.careers.microsoft.com/careers/job/...

The video for my 'What's my job again' talk from BSides Tampa has posted Video - www.youtube.com/watch?v=uVAA... Slides - www.slideshare.net/slideshow/wh... Roles standard - publications.opengroup.org/s252

Ever been tempted to call people "stupid users" because they make a basic security or technology mistake? I would advise against saying this and encourage you to change your thinking patterns. A short 🧵

I recently realized that the 'autonomous SOC' idea is the same old snake oil packaged up with a fancier and more intellectual-sounding name The 'technology can prevent attacks / stop breaches' claim that has been disproven over and over (similar to compliance claims) a 🧵

I am excited to talk about one of my favorite topics at BSides Tampa on May 16! *Security is a team sport (and we are NOT playing like a team)*

Pursuing perfect solutions is a perfect waste From Chapter 6 - How to Scope, Size, and Start Zero Trust (Page 78) of www.amazon.com/Zero-Trust-O... 🧵

Security is often incorrectly perceived as a 'technical problem' that can be 'solved' (it isn't!) by business leaders. *Security is an ongoing risk that requires ongoing work.* This misperception is often accidentally created or reinforced by the security team. 🧵

I just posted my slides from my talk on Zero Trust and AI Security at The Official Cybersecurity Summit in Tampa. Slides here - www.slideshare.net/slideshow/ai... Some photos from the event here - www.linkedin.com/posts/jan-br... Share and Enjoy!

I have come to appreciate that expectations for GenAI models (language models and similar) are often wrong. The technology is extremely powerful and impressive, but it is not like anything we have experienced or imagined as humans so we have to adjust our expectations a 🧵

I am finalizing this new data security diagram for the next version of the MCRA (aka.ms/MCRA) What do you all think? FYI, we first developed this for the Data Security workshop from Microsoft Unified (aka.ms/SAF)

Building and securing AI apps/agents is VERY different than classic apps. Instead of just asking "What did we BUILD into the app" -- we must also ask "How well did we CONSTRAIN the model?" 🧵

An Agile Roadmap One of the most critical elements of a strategy is a roadmap that lays out how to achieve that business vision. In today’s world of constant change, that roadmap must be agile so that it can be adapted and changed as you learn. 🧵

Design security policies to create a healthy level of friction Policies should be designed to set a productive and helpful level of “security friction” in business and technology processes. 🧵

Enable good security decisions by everyone in the organization 🧵

I am working on a new diagram for describing SecOps roles and how they fit into the operating model (aka teams/tier model) - thoughts? feedback?

What is agile security? Agile security is simply acknowledging that the real world is messy and unpredictable, and adapting to that. Zero Trust enables an agile approach to security. 🧵

🔷 If you reward business leaders to ignore cybersecurity, they will. 🔷 If you reward technology teams to ignore cybersecurity, they will. 🔷 If you think security teams can magically stop criminals and spies while this is happening, you are fooling yourself.

Never confuse accountability with responsibility. From the Security Roles and Glossary standard Part 2 : Section 4.4 🔷 Download the Standard - publications.opengroup.org/s252 🔷 Read the Article - www.linkedin.com/pulse/securi... 🧵

These may not be the droids... errr jobs that you are looking for. A lot of people mistake manager or leadership jobs for "technical person in charge" This slide is from a career talk I gave recently.

Always ruthlessly prioritize Regardless of the size of your Zero Trust efforts, you should always rigorously and intensely prioritize your effort, ensuring you are continually focused on driving quick wins and incremental progress.

Every place an IT admin enters or stores their credentials is a potential place for them to be stolen and abused for ransomware, data theft, and more. For guidance on how to secure privileged access, see aka.ms/SPA

Protecting people and society is why people _should_ care about cybersecurity, but fiduciary duty is why organizational leaders _must_ care about it. (short 🧵 with download link for an open standard at the end)

I just posted slides from my sessions at The Open Group conference last month. This includes slides from two sessions: ◼️ Security and Zero Trust Body of Knowledge Introduction and Overview ◼️ Security Roles and Glossary Standard Overview and Vision www.slideshare.net/slideshow/se... 🧵

Pursuing perfect security is a delusion The greatest obstacle to security success is assuming and expecting that perfect security is possible (or worthwhile to pursue). (1 of 2)

Security budget getting cut because you made progress? Worried the problems will come back as soon as you stop investing in security? You're probably right... a 🧵

If you reward technology teams to ignore cybersecurity, they will. If you think security teams can magically stop criminals and spies while this is happening, you are fooling yourself.

An organization can never be resilient until they stop rewarding "blame the scapegoat” behavior and start making people accountable for their actions and decisions. 🔷 If you reward business leaders to ignore cybersecurity, they will. ... a 🧵

This was one of my favorite slide sequences to create, partially because it allowed me to use one of my favorite games to illustrate important cybersecurity points. (and yes, there are animations and morph transitions in the downloadable slides - aka.ms/mcra) 🧵

Are you signing up for a 2 breach minimum? That's what often happens when you don't logs for security: a 🧵

Cybersecurity is part of EVERYONE’S Job Cybersecurity professionals are currently and always will be set up to fail (and blamed for those failures) UNLESS security accountability and responsibility are correctly assigned across business, technology, and security roles a 🧵

How can CISOs move from "Chief Incident Scapegoat Officer" to "key business partner who keeps me out of jail and keeps our assets safe"? How to become a trusted advisor instead of being sent to the kids table & ignored while waiting to be blamed/fired at the next incident? a 🧵

Is your access management strategy fragmented to the point where it only helps attackers and frustrates everyone in your organization? a short 🧵

AI is different. Building and securing AI Agents is fundamentally different - they are the programs/applications/apps of the AI platform, but managing risk from them is fundamentally different than previous apps because they come with so much functionality.

Looking for a list of cybersecurity roles and responsibilities? Check out the Security Roles and Glossary Standard we just published. www.linkedin.com/pulse/securi...

Episode #121 is out! We turn the tables and speak to @markasimos.bsky.social about new material from The Open Group. It's a long episode but worth it! Also, the news!

I recently put together this summary of how AI impacts different disciplines in security. Thoughts? Feedback? Anything I missed?

The Open Group just published a Security Roles and Glossary standard defining security responsibilities and accountabilities. publications.opengroup.org/s252 publications.opengroup.org/s253 publications.opengroup.org/s254 publications.opengroup.org/s255 short 🧵with key points...

The Microsoft Ignite Book of News is released. I highly recommend taking a quick look through it as there is a lot of security news and releases (keyword search had 172 hits on the word security 🙂) news.microsoft.com/ignite-2025-...

I am working on a new antipattern that is a real pet peeve of mine. I pretty much stop listening after I hear "This attack would have been stopped by..." short 🧵(rant)

Security teams cannot operate in isolation and CISOs should not be the only roles who talk to business leaders and other teams. Most people in a security team should be interacting with non-security people across technology and business teams.

I found myself using this career advice slide a lot lately and thought I would share it more broadly.

We were tempted to add this to the security glossary definitions, but we reluctantly decided to take it out (see? standards people have a sense of humor as well 😀) For more on roles and glossary standard (and others in this body of knowledge), see lnkd.in/gyd-3T39

Attackers want, cheap, easy, and reliable access to your assets. The job of defenders is to take those away from them. Everything in security is about removing the cheap, easy, and reliable options from the threat actor menu.

We spent some time working on security capabilities for the next revision of the Zero Trust Reference Model standard at The Open Group conference short 🧵 with some updates and insights