Frederic Petit

Day Two: Mapping Vulnerabilities and Early Warning Systems Fraud prevention begins with knowledge acquisition. Vulnerability mapping requires both documentary review and human insight. Employees often know where the controls are weakest, and their observations must be collected systematically. Early warning systems, such as anomaly detection in billing, transaction thresholds in finance, or ownership transfer reviews in real estate, provide practical mechanisms for spotting irregularities. By the end of this day, the compliance officer should produce a preliminary vulnerability map and identify at least three early warning indicators. For more, go to: IVSinc.org and check the Blog. (Caution: It may take a bit for the new blog to appear.) Come back tomorrow for a link to “Day Three: Building Practical Controls and Safeguards” IVSinc.org

4

The DVMS Institute has partnered with Navvia to deliver next-gen cyber governance, resilience, and training via Navvia’s NIST CSF assessment and process modeling platform. We are thrilled to partner with Navvia to bring a truly operationalized approach to digital value governance and cyber resilience. The combination of DVMS Institute’s cyber resilience overlay system and Navvia’s powerful NIST-CSF assessment and process design and management platform provides organizations with a comprehensive solution for aligning governance, risk, and performance assurance with their digital risk and value management strategy.” David Mainville, CEO of Navvia, shared similar enthusiasm: “Our mission has always been to simplify and accelerate an organizational ability to assess and document its governance, compliance, and service improvement initiatives. With the introduction of our new Cybersecurity Framework assessment tool - combining NIST CSF with ITSM Processes, and our partnership with the DVMS Institute, we offer clients a best-in-class solution to assess, build, measure, and sustain cyber resilience and governance excellence. We are helping organizations turn cybersecurity from a reactive technical problem into a strategic business advantage.” For more information about Navvia’s NIST CSF assessment solution and the DVMS Institute’s digital value management frameworks, visit www.navvia.com and www.dvmsinstitute.com . https://lnkd.in/gKKQMBju

13

2 Comments

The future of cyber defense depends on one thing: adding a Human Contextual Inference Layer (HCIL) to your operations. SOCs today are flooded with alerts, data, and automation — yet still lack what matters most: context about the human behind the signal. HCIL fuses behavioral, contextual, and technical telemetry to reveal why something is happening, not just what. It’s how defenders move from reactive triage to proactive understanding — anticipating insider threats before they manifest. At Red Vector, our Fulcrum platform operationalizes HCIL, giving organizations the ability to see risk in context and act decisively. Add Context. Stop the Drifters.™ 👉 Learn more: https://www.redvector.ai #InsiderRisk #CyberSecurity #ThreatIntelligence #BehavioralAnalytics #AI #HCIL #RedVector #Fulcrum

8

Claude Code Security: First Major Sign of Guardian Agents Disrupting Incumbent #Security Market Claude Code Security, #Claude Code’s embedded guardian agent, is a clear signal from Anthropic that frontier AI is moving into code security, directly disrupting the incumbent security tooling market. ‼️ Whether or not this particular product is effective is not the point. The point is the larger market trend. 👉 My own view is that Guardian Agents will eliminate the need for almost half of incumbent risk and security systems protecting AI agent activities in over 50% of organizations in the next few years. ✅ This prediction reflects the rapid maturation of agentic AI ecosystems, where the developers and providers of guardian agents themselves can’t wait for incumbent security systems to provide the information and signals they need. ✅ Instead, to protect AI agents in the enterprise, these guardian agents are being forced to natively handle agent identity management, dynamic data classification and sensitivity mapping, real-time monitoring and cleanup of agent permissions and tool access. Of course, they link to enterprise incumbent security and data controls when they exist to enrich their own controls, but they do not and cannot rely on them. ✅ Independent guardian agents provide clear visibility into what sensitive data or systems each agent could potentially access or impact, contextual risk assessment, and runtime adaptation to continually changing situations —by continuously fusing threat intelligence with internal/external signals into enriched feeds for detection and response. ✅ Equipped with this self-contained intelligence, independent Guardian Agents deliver native protection that combines deterministic methods (explicit policy engines, rule-based guardrails, and verifiable controls) with AI-driven reasoning to monitor, constrain, and optimize every agent action at runtime without relying on external systems for data classification, identity management and other security functions. 👀 I’ve seen some of these new Guardian Agent solutions in action. 👀 🎯 My conclusion: the good ones will render many current incumbent security layers redundant. 🎯 I'm not sure how Claude Code Security stacks up but I am sure this disruption is real. #aiagent #guardianagent #aitrism #AIsecurity #cybersecuruity #AI Gartner Daryl Plummer Dionisio Zumerle Max Goss Carlton E. Sapp, Ph.D. Tom Coshow

181

30 Comments

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5