Cybersecurity is part of EVERYONE’S Job Cybersecurity professionals are currently and always will be set up to fail (and blamed for those failures) UNLESS security accountability and responsibility are correctly assigned across business, technology, and security roles a 🧵

How can CISOs move from "Chief Incident Scapegoat Officer" to "key business partner who keeps me out of jail and keeps our assets safe"? How to become a trusted advisor instead of being sent to the kids table & ignored while waiting to be blamed/fired at the next incident? a 🧵

Is your access management strategy fragmented to the point where it only helps attackers and frustrates everyone in your organization? a short 🧵

AI is different. Building and securing AI Agents is fundamentally different - they are the programs/applications/apps of the AI platform, but managing risk from them is fundamentally different than previous apps because they come with so much functionality.

Looking for a list of cybersecurity roles and responsibilities? Check out the Security Roles and Glossary Standard we just published. www.linkedin.com/pulse/securi...

Episode #121 is out! We turn the tables and speak to @markasimos.bsky.social about new material from The Open Group. It's a long episode but worth it! Also, the news!

I recently put together this summary of how AI impacts different disciplines in security. Thoughts? Feedback? Anything I missed?

The Open Group just published a Security Roles and Glossary standard defining security responsibilities and accountabilities. publications.opengroup.org/s252 publications.opengroup.org/s253 publications.opengroup.org/s254 publications.opengroup.org/s255 short 🧵with key points...

The Microsoft Ignite Book of News is released. I highly recommend taking a quick look through it as there is a lot of security news and releases (keyword search had 172 hits on the word security 🙂) news.microsoft.com/ignite-2025-...

I am working on a new antipattern that is a real pet peeve of mine. I pretty much stop listening after I hear "This attack would have been stopped by..." short 🧵(rant)

Security teams cannot operate in isolation and CISOs should not be the only roles who talk to business leaders and other teams. Most people in a security team should be interacting with non-security people across technology and business teams.

I found myself using this career advice slide a lot lately and thought I would share it more broadly.

We were tempted to add this to the security glossary definitions, but we reluctantly decided to take it out (see? standards people have a sense of humor as well 😀) For more on roles and glossary standard (and others in this body of knowledge), see lnkd.in/gyd-3T39

Attackers want, cheap, easy, and reliable access to your assets. The job of defenders is to take those away from them. Everything in security is about removing the cheap, easy, and reliable options from the threat actor menu.

We spent some time working on security capabilities for the next revision of the Zero Trust Reference Model standard at The Open Group conference short 🧵 with some updates and insights

One thing that has been bugging me about this whole "AI replacing jobs" topic is that the discussion is too sloppy to reach a meaningful understanding or conclusion. This post is a bit pedantic, but I have a reason for the details so bear with me :-) a 🧵

On Monday in Houston, I am presenting the Security and Zero Trust body of knowledge + first release of the new Security Roles and Glossary standard. I will post slides afterward, but sharing this sneak peek of the session with the overarching goals of the standards in this body of knowledge

We’re working on updating the disciplines of the Microsoft Security Adoption Framework (SAF) and wanted to get your feedback Current guidance is on aka.ms/SAF a 🧵

I will be speaking in person in Houston at The Open Group Event in Houston next week! We will be formally announcing some new security standards and hope to see you there! meet.opengroup.org/event/Housto...

Security Posture Management is often the forgotten discipline in the cybersecurity profession. a 🧵

Security success is attacker failure, but we can never guarantee that we can stop every attack. Because you will inevitably experience damage from successful cybersecurity attacks, its critical to focus on building resilience by ensuring that you can:

I spend many of my working hours building workshops (MCRA, CISO Workshop, and others in the SAF) to help organizations guide their security modernization journey with learnings and best practices from Microsoft and our customers.

Should IT teams let security professionals patch and reboot your servers anytime they want? Should security professionals be able to update your code and deploy it anytime they want?

One type of role really stood out from all of the others as we standardized security responsibilities and accountabilities across all roles in an organization. The Information Worker/Frontline Worker (marked with a star) is the heart and core of the organization rant/🧵

Security success is attacker failure, but we can never guarantee that we can stop every attack. Because you will inevitably experience damage from successful cybersecurity attacks, its critical to focus on building resilience by ensuring that you can: (1/2)

I recently created this graphic on how securing AI is different from classic (deterministic) code. Thoughts? Feedback?

I recently created this slide to tell the story of the different eras of security as the world (and security/tech industry) woke up to the different dimensions of security Thoughts? Feedback? Memories? short 🧵

I had a great time presenting the MCRA at BSides St. Pete! Great conference, great community, really enjoyed it!

Just wrapped up my 4 hour training at BSides St. Pete. Great conversations with seasoned pros, career changers, new to industry, and students. This is a new slide I created this morning for the class that really encapsulates what it takes to be a whole security professional.

One of the interesting things we learned as we defined standard jobs/roles for the Zero Trust Playbook series and The Open Group standard for the Security Roles and Glossary is the nature of _what a role really is_. a short 🧵

Security doesn’t get better until we correct our underlying broken assumptions short 🧵

Want 4 hours of training on security roles and careers for a buck!?!? Join me for a half day training session at BSides St. Pete (near Tampa FL) on Friday October 3 bsides-st-pete.sessionize.com/schedule

Security isn't just the security team's job. This became extremely clear to me during work on the security matrix standard when we broke attacks down to these two fundamental types of attack techniques: a 🧵

Wanna see MCRA live? Saturday 4 October at BSides St. Pete (near Tampa) bsides-st-pete.sessionize.com/session/968974 Looking forward to seeing you there!

If a CISO says “I accept the risk”, your security has already failed (but not necessarily for the reason you think) www.linkedin.com/pulse/securi... a short 🧵

I recently created a slide on cybersecurity industry maturity. It shows the aim of The Open Group work to drive clarity with definitions of durable outcomes, common roles, accountability/responsibility, glossary, etc.) This article has more information - www.linkedin.com/pulse/securi...

I just update Mark's List (of Cybersecurity resources frequently sent to customers and colleagues) Share and Enjoy! aka.ms/markslist

Getting ready to present live on this RSAC Virtual Seminar! Hoping to see you there! www.linkedin.com/posts/marksi...

I've been working on a list of AI antipatterns and best practices. Thoughts? Feedback? Anything we missed?

I will be speaking at this free event to talk about security roles and getting the accountability right (hint: its not just about dumping blame on the security team 😉) Hope to see you there! spr.ly/6044fWmls

I will be presenting a keynote at the Packt one-day virtual summit covering the evolving world of Gen AI security (September 13, 2025) "Beyond the Buzzwords: Making AI and Zero Trust Real" www.eventbrite.com/e/next-gen-c... (🎟️ currently running a 2-for-1 deal) Hope to see you there!

We just released an updated Access and Identity module of the Security Adoption Framework (SAF), so it is now available to all Microsoft Unified customers. If you are interested in this workshop, contact your Microsoft representative (customer success account manager - CSAM) 🧵

I just posted an article describing the work I am contributing to at The Open Group on Security and Zero Trust. www.linkedin.com/pulse/securi...

As part of research for the roles and glossary standard, I have been reading through job descriptions see how they are written (for security architecture, engineering, CISOs, etc.). Some are good, but I also noticed a lot of antipatterns (common mistakes) including: (a short 🧵)

The central challenge of life is that perception and reality are not always aligned.

Microsoft Sentinel Data Lake is in public preview! www.microsoft.com/en-us/securi...

Microsoft was recently named a leader by Forrester for Zero Trust (and the highest rated on strategy) I was honored to support this team effort to show Microsoft strategy and offerings for this rigorous analyst evaluation. www.microsoft.com/en-us/securi...

One of the biggest security mistakes we see organizations make for security is blaming the security experts for decisions and actions outside of their control. a short 🧵

We would love your thoughts and feedback on how we are defining threat data vs. threat intelligence vs. security intelligence. We took some stands on terminology to clarify confusion and wanted to get feedback on it. www.linkedin.com/pulse/words-...

Threat intelligence responsibilities - I am working on defining these for an upcoming standards publication. Is there anything missing? phrased oddly or incorrectly? any other feedback? Larger context for this effort described in this article - www.linkedin.com/pulse/people...