I recently created this graphic on how securing AI is different from classic (deterministic) code. Thoughts? Feedback?

I recently created this slide to tell the story of the different eras of security as the world (and security/tech industry) woke up to the different dimensions of security Thoughts? Feedback? Memories? short 🧵

I had a great time presenting the MCRA at BSides St. Pete! Great conference, great community, really enjoyed it!

Just wrapped up my 4 hour training at BSides St. Pete. Great conversations with seasoned pros, career changers, new to industry, and students. This is a new slide I created this morning for the class that really encapsulates what it takes to be a whole security professional.

One of the interesting things we learned as we defined standard jobs/roles for the Zero Trust Playbook series and The Open Group standard for the Security Roles and Glossary is the nature of _what a role really is_. a short 🧵

Security doesn’t get better until we correct our underlying broken assumptions short 🧵

Want 4 hours of training on security roles and careers for a buck!?!? Join me for a half day training session at BSides St. Pete (near Tampa FL) on Friday October 3 bsides-st-pete.sessionize.com/schedule

Security isn't just the security team's job. This became extremely clear to me during work on the security matrix standard when we broke attacks down to these two fundamental types of attack techniques: a 🧵

Wanna see MCRA live? Saturday 4 October at BSides St. Pete (near Tampa) bsides-st-pete.sessionize.com/session/968974 Looking forward to seeing you there!

If a CISO says “I accept the risk”, your security has already failed (but not necessarily for the reason you think) www.linkedin.com/pulse/securi... a short 🧵

I recently created a slide on cybersecurity industry maturity. It shows the aim of The Open Group work to drive clarity with definitions of durable outcomes, common roles, accountability/responsibility, glossary, etc.) This article has more information - www.linkedin.com/pulse/securi...

I just update Mark's List (of Cybersecurity resources frequently sent to customers and colleagues) Share and Enjoy! aka.ms/markslist

Getting ready to present live on this RSAC Virtual Seminar! Hoping to see you there! www.linkedin.com/posts/marksi...

I've been working on a list of AI antipatterns and best practices. Thoughts? Feedback? Anything we missed?

I will be speaking at this free event to talk about security roles and getting the accountability right (hint: its not just about dumping blame on the security team 😉) Hope to see you there! spr.ly/6044fWmls

I will be presenting a keynote at the Packt one-day virtual summit covering the evolving world of Gen AI security (September 13, 2025) "Beyond the Buzzwords: Making AI and Zero Trust Real" www.eventbrite.com/e/next-gen-c... (🎟️ currently running a 2-for-1 deal) Hope to see you there!

We just released an updated Access and Identity module of the Security Adoption Framework (SAF), so it is now available to all Microsoft Unified customers. If you are interested in this workshop, contact your Microsoft representative (customer success account manager - CSAM) 🧵

I just posted an article describing the work I am contributing to at The Open Group on Security and Zero Trust. www.linkedin.com/pulse/securi...

As part of research for the roles and glossary standard, I have been reading through job descriptions see how they are written (for security architecture, engineering, CISOs, etc.). Some are good, but I also noticed a lot of antipatterns (common mistakes) including: (a short 🧵)

The central challenge of life is that perception and reality are not always aligned.

Microsoft Sentinel Data Lake is in public preview! www.microsoft.com/en-us/securi...

Microsoft was recently named a leader by Forrester for Zero Trust (and the highest rated on strategy) I was honored to support this team effort to show Microsoft strategy and offerings for this rigorous analyst evaluation. www.microsoft.com/en-us/securi...

One of the biggest security mistakes we see organizations make for security is blaming the security experts for decisions and actions outside of their control. a short 🧵

We would love your thoughts and feedback on how we are defining threat data vs. threat intelligence vs. security intelligence. We took some stands on terminology to clarify confusion and wanted to get feedback on it. www.linkedin.com/pulse/words-...

Threat intelligence responsibilities - I am working on defining these for an upcoming standards publication. Is there anything missing? phrased oddly or incorrectly? any other feedback? Larger context for this effort described in this article - www.linkedin.com/pulse/people...

I just posted the slides from my "What's my job again?" talk that I delivered at Tampa BSides in May. This talk covered what security jobs there are to be done in an organization (we found 73 so far across security, technology, and business teams). www.slideshare.net/slideshow/wh...

Attackers only have about six main operating models. While they have nearly infinite options to exploit your people/process/technology, getting benefit from these attacks comes from one (or more) of these six operating models: 🧵

We just released the Data Security module of the Security Adoption Framework (SAF) to the catalog so it is now available to all Microsoft Unified customers. (short 🧵)

When & how are you doing root cause analysis for major incidents? How often? Any specific criteria on what incidents you do it on? criteria/taxonomy/format for the reports? Any other lessons learned or feedback? This is draft text from an upcoming publication I am working on

Does your change process consider Security Operations (SecOps/SOC) requirements as new solutions are reviewed and approved? I am looking for feedback on this text for an upcoming publication. (1 of 2)

The Security Principles for Architecture have recently been published in markdown format (no need to download PDF) digital-portfolio.opengroup.org/security-sta...

Never talk tech to business When you throw security/technical jargon at business leaders, you send a clear message that security is a specialized technical thing that they don't need to understand or care about. a short 🧵

Security Architecture: What It Is, Why Bother, and How To Do It I was on this panel that covered a wide range of aspects from some of us seasoned architects (e.g. some of us are old and have seen things :-). publications.opengroup.org/webinars/d335

The Zero Trust Commandments have recently been published in markdown format (no need for login/account/etc.) digital-portfolio.opengroup.org/security-sta...

Microsoft's Secure Future Initiative (SFI) is a Zero Trust initiative tailored to Microsoft's needs. You can think of SFI as a kind of Zero Trust case study from Microsoft that you can learn from to improve your own security. www.microsoft.com/en-us/securi... a short 🧵

Do you want to be a manager? Are you sure? Are you really sure those are the droids… errr jobs…. you are looking for? Being a manager is not senior technologist or anything like it. a 🧵

I gave some career advice for security practitioners at a recent talk at BSides Tampa and thought I would share this one. (I will post link to full recording when available) a 🧵

The most convenient and efficient way to operate a bank is where everything you need for customers is in easy reach. So why do we store cash and valuables in bank vaults and safety deposit boxes? Because it would be insanely easy to steal! short 🧵

Episode #113 is out! In this episode Michael, @markasimos.bsky.social and @sarahyo.com speak to Craig Nelson about red teaming within Microsoft. He shares his insightful thoughts about how red teaming is a critical piece for protecting both the Azure platform and Microsoft. Also, the news!

What would you say you do here? I am finishing up my BSides Tampa talk "What's my job again" and realized this talk will help answer this classic 'Office Space' question 😂 Talk is Saturday 5/17 at 11am in career track -https://events.bsidestampa.net/BSidesTampa2025#/agenda?day=2&lang=en

What common mistakes do you see business leaders make with cybersecurity? Seen these? Seen other mistakes? 🧵 1 of 2

A tale of two (large) purchases and cybersecurity Let’s take the case of purchasing a new expensive software-controlled piece of equipment that supports business operations like MRI Machines, heavy manufacturing equipment, ATM Machines, etc. a short 🧵

BSides means new slides 😀 I am working on slides for my Tampa BSides presentation this Saturday May 17 This is one of my new favorites showing security leaders educating & influencing organizational leadership while guiding, coaching, and clearing obstacles for their teams

The problems of security are simple. Solving them is hard. We added a new slide in the MCRA to communicate these challenges for many different people to understand (business leaders, security professionals, technology professionals, and more). Download deck & slide notes here - aka.ms/mcra

Hey all, this video covers several important topics: 1️⃣ Ensuring security notifications are set up right to get the right people working on it right away. 2️⃣ How SecOps/SOC roles work these notifications from an external party like Microsoft (including outsourcing commentary) 🧵

The final episode of Secure Future Initiative Tech Tips just dropped! Michael and I chat with @markasimos.bsky.social about how to set up security alerts and how to act upon them as part of the Accelerate response and remediation pillar. www.youtube.com/watch?v=ieLq...

Are you focusing on the important parts of cybersecurity first? It's critical to ruthlessly prioritize in cybersecurity because there is an infinite number of ways that attackers could possibly attack your systems. a 🧵

April 2025 version of MCRA is out! This release of the Microsoft Cybersecurity Reference Architectures (MCRA) focuses on updates for standards/mappings, product/technology changes, and more. Download PowerPoint (including slide notes) from usual site - aka.ms/MCRA

Does your organization formalize security experts as a powerless scapegoat? If your security team is blamed (implicitly or explicitly) for decisions they don't make, then your accountability structure is broken. 🧵 - 1 of x

I just wrote a line: -- Delegating the security outcomes of business decisions to a security team (without the power to change the original decision) formalizes security as a powerless ‘scapegoat’ where their only real job is to accept blame when those decisions end badly.