I'm retiring as of tomorrow, so this work account will be going dark. (It seems likely I'll do some freelance work in 2026, so I'm not shutting down the acct. But I'm taking it easy a few months.) I do have a personal account here, but it seems weird to post the link. Feel free to DM me, though.

New on @darkreading.bsky.social, commentary by Liad Cohen and Eyal Paz, OX Security: "By addressing these risk vectors, organizations can continue leveraging GitHub's innovation while protecting against the sophisticated supply chain attacks targeting our interconnected software ecosystem."

New on @darkreading.bsky.social, commentary by Aditya K. Sood, VP of Security Engineering & AI Strategy, Aryaka: "Today's RATs don't just exploit technical vulnerabilities. They also take advantage of the blind spots created by how enterprise architects establish their security environments."

New on @darkreading.bsky.social, commentary by Ivanti's Field CISO Mike Riemer: "When security becomes part of the development culture rather than an external constraint, teams start thinking about security implications naturally as they build features."

New on @darkreading.bsky.social, commentary by Ofri Ouzan, Security Researcher & Advocate, JFrog: CVE scoring systems "often fail to account for the unique context of each organization's environment. As a result, teams risk focusing on theoretical risks while genuine threats may be overlooked."

New on @darkreading.bsky.social, commentary by Lane Sullivan, Chief Information Security & Strategy Officer, Concentric AI: "Being a CISO today is a balancing act of strategic leadership, financial literacy, technical expertise, and human connection, regardless of [company size]."

New on @darkreading.bsky.social, commentary by Melina Scotto, Founder, Mastin & Associates: "Consider securing AI as your next career opportunity to transform challenges into a strategic advantage and build cyber resilience in a rapidly changing, AI-enabled, digital world."

New on @darkreading.bsky.social, commentary by Pritesh Parekh, CISO, PagerDuty: "In an era where cyber threats are increasingly sophisticated and pervasive, the importance of post-incident security reviews cannot be overstated." Get tips on organizing your own reviews.

New on @darkreading.bsky.social, commentary by Trend Micro's Jon Clay: "While the cybercriminal underground has professionalized and become more organized in recent years, threat actors are, to a great extent, still using the same attack methods today as they were in 2020."

Get the latest news from Black Hat this week. www.darkreading.com/keyword/blac...

Scoop: CISA's contract with ICF has expired, reducing the JCDC's contractor workforce from 100+ to just 10. CISA can use emergency money & 2-week extensions to keep those 10 around, but only through Sept. Other contracts also caught up in huge backlog. www.cybersecuritydive.com/news/cisa-jo...

New on @darkreading.bsky.social, commentary by Alisdair Faulkner, Darwinium: "We must accept that malicious agents will often appear legitimate — and gain access. Defending against them requires speed, but not at the expense of paralyzing online commerce."

New on @darkreading.bsky.social, commentary by Roger Cressey, Mountain Wave Ventures: "As we reflect on the anniversary of the largest outage in IT history, organizations everywhere need to make an active effort to ... create a more robust and resilient cyber ecosystem moving forward."

New on @darkreading.bsky.social : "By tying security investments to measurable outcomes — like reduced breach likelihood and financial impact — CISOs can align internal stakeholders and justify spending based on real-world risk." Commentary by Kara Sprague, CEO, HackerOne

New on @darkreading.bsky.social: "Many CISOs still find themselves speaking a technical language that fails to resonate with other leaders. Technical terms often fall flat in boardrooms more concerned with revenue growth and brand reputation." Commentary by Ashley Rose, Living Security

New on @darkreading.bsky.social: "Today's insider threats aren't lone wolves acting out of spite — they're pawns in the hands of sophisticated, organized criminal networks." Commentary by Rob Juncker, Mimecast

New on @darkreading.bsky.social: "Agentic AI could be a disaster for authorization systems in software-as-a-service (SaaS) platforms as we know them today. But it doesn't have to be, if security and IT teams address the challenges proactively." Commentary by Josh Lemos, GitLab. chaos

My new story about the U.S. government’s fraying partnerships with critical infrastructure operators is packed with new reporting, but there’s a lot more that I couldn’t fit into the story. Here are some more details from my interviews over the past few weeks about where things stand…

New on @darkreading.bsky.social: "The software development ecosystem needs clear requirements for AI transparency and a dedicated risk-disclosure framework. This framework should document key attributes such as training data sources, model versions, known limitations, and security features."

New: Trump's federal workforce chaos is upending govt partnerships with U.S. critical infrastructure operators, jeopardizing work to protect vital services like healthcare and water from hackers & natural disasters. My @cybersecuritydive.bsky.social‬ story: www.cybersecuritydive.com/news/critica...

New on @darkreading.bsky.social: "Taking senior analysts out of repetitive triage loops gives them space to apply judgment, creativity, and curiosity to the harder problems." Erick Wille, CISO, Cabinetworks www.darkreading.com/vulnerabilit...

New on @darkreading.bsky.social: "As AI transforms how enterprises operate, a new mandate [for CISOs] has emerged: Govern its use responsibly, end to end." Commentary by Ben de Bont, CISO, ServiceNow www.darkreading.com/vulnerabilit...

New on @darkreading.bsky.social: "To truly future-proof your cybersecurity approach, it's vital to ensure that your security program is flexible and adaptable to both current and future business demands." Brent Stackhouse, Vice President of Security & GRC, WP Engine

New on @darkreading.bsky.social: "Cybercrime response needs more aggressive actions from those seeking to protect victims and pursue criminals. What, then, should we pursue? Everything. Everywhere. All at once. And always." James Shank, Director, Threat Operations, Expel

Generative AI is helping hackers write better malware, phish more convincingly, and seed open-source repositories with backdoors, a Gartner expert said at the company's security conference on Monday. www.cybersecuritydive.com/news/ai-cybe...

New commentary on @darkreading.bsky.social: "SSH keys aren't going anywhere. But unmanaged keys are a risk your organization doesn't need to take. Start by treating them like what they are: powerful credentials that deserve serious oversight."

New @darkreading.bsky.social: "Alert fatigue isn't merely an operational challenge; it's an existential threat to security effectiveness." Boaz Barzel, Field CTO, OX Security

New on @darkreading.bsky.social: "Next-gen developers are crucial, and now is the time to ready the development cohort to leverage AI effectively and safely." Pieter Danhieux, CEO, Chairman & Co-Founder, Secure Code Warrior

New: CISA has already lost ~1,000 employees to Trump's workforce purge, with the marquee Cybersecurity Division hit hard and many departures from the agency's field force of local cyber advisers. www.cybersecuritydive.com/news/cisa-de... Confirming @samsabin.bsky.social‬'s scoop.

New: Broad coalitions of cyber firms, think tanks, former govt officials, and experts are backing Trump's nominees for CISA director and national cyber director, a sign of the perceived urgency of filling a leadership void. Confirmation hearing is Thursday. www.cybersecuritydive.com/news/trump-c...

New on @darkreading.bsky.social: "If speed and security aren't reconciled, 'fastest first mover' is likely to dictate that speed wins and the epidemic of vulnerabilities that characterizes much of popular software today carries over into the AI age." Andrew Grotto, Stanford University

New on @darkreading.bsky.social: "CISOs are the most qualified among leadership to understand and translate complex threats into business language and chart courses for the company that ensure survival and bring a competitive advantage." Richard Marcus, AuditBoard

New on @darkreading.bsky.social: "This isn't about waving red flags after the build pipeline is already green. This is about being in the room when the feature is defined, before a single prompt is typed into the AI tool." Commentary by Michael Nov, Prime Security #vibecoding

New on @darkreading.bsky.social: "A robust framework for AI ethics and compliance should prioritize transparency, regulatory adaptability, and the adoption of privacy-enhancing technologies." Jimmy Astle, Senior Director of AI Platform and Data Science, Red Canary

New on @darkreading.bsky.social: Dark Reading Confidential Podcast Threat hunters Ismael Valenzuela and Vitor Ventura share stories about the tricks they used to track down advanced persistent threat groups, and the surprises they discovered along the way. (You'll also hear my dulcet tones.)

New on @darkreading.bsky.social: "There are certain categories of risks that security and compliance professionals must consider when evaluating the use of any open source AI platform within their organizations." Maurice Uenuma, Vice President & General Manager, Americas, Blancco

New on @darkreading.bsky.social: Dark Reading Confidential Podcast Threat hunters Ismael Valenzuela and Vitor Ventura share stories about the tricks they used to track down advanced persistent threat groups, and the surprises they discovered along the way. (You'll also hear my dulcet tones.)

New on @darkreading.bsky.social: "Insecurity in a system like this doesn't make noise. It accumulates in overlooked training, slower coordination, and weaker responses, eroding cyber resilience from the inside out." Haris Pylarinos, Founder & CEO, Hack The Box

New on @darkreading.bsky.social: "Most organizations are still writing policies like it's 2019. The ones that stay ahead won't be the most compliant — they'll be the most honest about what actually works." Aditya Gupta, Industry Principal, Infosys www.darkreading.com/vulnerabilit...

New on @darkreading.bsky.social: "To increase your cost to exploit, I recommend focusing on a few tactics. First, shift security left in the development process." Isaac Evans, CEO, Semgrep

New on @darkreading.bsky.social: The RSAC 2025 Innovation Sandbox competition "saw a majority of startups attempting to secure agentic frameworks or deploy AI agents within their solutions." Cybersecurity analyst Paul Shomo provides an overview of the competition. #agentic

New on @darkreading.bsky.social: "Inference-time risks are real and immediate — they need to be addressed with the same discipline as any other system constraint." Liam Crilly, Senior Director of Product Management, F5

New on @darkreading.bsky.social: Part 1 of video coverage of last week's #RSAC coverage, with a focus on AI. www.darkreading.com/cloud-securi...

New on @darkreading.bsky.social: "Spinning up cloud infrastructure these days feels like unlocking a cheat code. A few lines of infrastructure as code (IaC), a push to deploy, and you're live. But the same speed that makes IaC amazing also makes it risky." Jatin Mannepalli, IMC Trading

New on @darkreading.bsky.social: "The lesson we learned from this customer incident is that it's not easy to reason with the unreasonable." Steve Stasiukonis, President, Secure Network

New on @darkreading.bsky.social: "What's going on here? Is this the beginning of 'The Terminator'? No, it's not due to malice or sentience, but because of conflicting objectives, flawed data, and unintended programming consequences." Marla Hay, Salesforce

New on @darkreading.bsky.social: "The private sector can't afford to stay passive. That means stepping up: sharing intel, collaborating more, investing in collective defense." Audian Paxson, Principal Technical Strategist, IRONSCALES

New on @darkreading.bsky.social: "By focusing on prevention, education, and risk transfer through cyber insurance, organizations — especially at-risk small and medium-sized enterprises — can take the necessary steps to protect themselves from threats of cyberattacks." Erich Kron, KnowBe4

New on @darkreading.bsky.social: "The recent DeepSeek security breach has once again highlighted the significant vulnerabilities in artificial intelligence (AI) systems and raises alarming questions about where the exposed data may have ended up." Emma Zaballos, Senior Researcher, CyCognito

New on @darkreading.bsky.social: "As sophisticated threat groups worm their way into critical infrastructure and lay the groundwork for physical disruptions, corporate boards need to get serious on OT security risk." Warren O'Driscoll, NTT DATA UK&I