Jonathan Hunsucker, CISSP, GSTRT, and GICSP

Watching the UNFI cyberattack play out locally is a brutal but clear reminder: We’ve centralized too much power in too few hands—and when they go down, everyone feels it. One company, one breach… and tens of thousands of businesses are left scrambling. Deliveries canceled. Shifts cut. It’s not just a systems outage—it’s a ripple effect touching communities, workers, and families who had nothing to do with the breach. Yes, tech matters. But resilience matters more. If we don’t start building more redundant, diverse, and local supply networks, we’ll keep finding ourselves here—at the mercy of single points of failure. There’s massive opportunity for smaller, more agile players to step up. To build smarter, more resilient, regionally focused networks. But here’s the catch: they need access to capital to do it right. This isn’t just about disruption—it’s about rethinking infrastructure, decentralizing dependency, and funding the future of food and beverage. There’s room at the table. The question is—who’s willing to invest in it?

24

5 Comments

The $100K Layoff: The Unacceptable Risk of the Insider Threat ​This is not a story about revenge; it's a critical case study in Privilege Escalation and Insider Risk Management that every IT leader and CEO needs to review. ​In 2019, Texas-based software developer Davis Lu, anticipating a layoff, planted a malicious 'kill switch' in his company’s network. The code, chillingly named "IsDLEnabledinAD," was designed to trigger upon his account deactivation. ​The Triggered Fallout: ​System Failure: The entire global system was compromised, leading to infinite loops, server crashes, and critical operational halts. ​Data Destruction: Thousands of global employees were locked out, and critical files were deleted. ​Financial Damage: The employer reported losses in the hundreds of thousands of dollars. ​Lu ultimately faced 4 years in federal prison, but the question for the industry remains: Why did a single employee have the administrative access to cause this level of catastrophic, automated damage? ​Key Takeaways for Risk Mitigation: ​Principle of Least Privilege (PoLP): Were Lu's admin keys truly necessary for his reduced role after the 2018 corporate realignment? Access must be dynamically tied to current responsibilities. ​Automated Offboarding: Tying the kill switch directly to his Active Directory deactivation shows a crucial failure in the offboarding protocol. Deprovisioning must be staggered and monitored, not a single, unmonitored action. ​Code Review & Audit Trails: How did malicious code with explicit names like "Hakai" (Japanese for "destruction") bypass code review and enter the production environment unnoticed? If you are a CIO, CISO, or HR leader, what is your most critical immediate step to secure server access before a high-risk employee termination? ​👇 Share your best practice for mitigating the Insider Threat in the comments below. ​#InsiderThreat #CyberSecurity #RiskManagement #Layoffs #HRTech #DevSecOps ​✅ Follow me for deep dives into real-world security failures and actionable risk management strategies.

1

Pragmatic, strategic governance is fundamental to security departments at large organizations. With sound department standards, operational procedures, and technical standards we can manage at scale, lowering risk, liability, and expenses. I share a little insight on the topic here in this recent interview with Security Journal Americas (SJA). PPG The Security Foundation (TSF) International Security Management Association (ISMA) Diplomatic Security Service OSAC

100

6 Comments

I've briefed Fortune 500 audit committees, executive leadership teams, and military generals. None of them want to hear about your firewall rules. They want three numbers that actually matter to the business: **Mean Time to Detect (MTTD)** Not "we have 47 security tools." They want → "We detect threats in 12 minutes vs. industry average of 287 days." Real impact. Real timeline. Real comparison. **Business Risk Exposure ($)** Not "we mitigated several vulnerabilities." They want → "$2.3M in potential business disruption reduced to $180K through proactive remediation." Translate technical risk into dollars they understand. **Security Debt Ratio** Not "we're implementing new controls." They want → "18% of our security infrastructure needs modernization, down from 34% last quarter." Show them you're fixing the foundation, not just patching holes. Here's what I learned after these briefings: Executives don't care about your CVSS scores or vulnerability counts. They care about business continuity, financial impact, and forward progress. The moment you start speaking their language — dollars, timelines, and trend lines — you get budget approvals instead of blank stares. Your cybersecurity program is only as strong as your ability to communicate its value to people who've never configured a firewall. What metrics do you use to translate technical risk into business language? #CyberSecurity #CISO #RiskManagement #ExecutiveLeadership #InfoSec

37

11 Comments

Tuesday's reading. Booz Allen’s new report warns that cybersecurity has entered a “new phase” as AI tools give attackers unprecedented speed and scale, forcing defenders to move faster or fall behind. Threat actors are adopting LLMs and agentic tooling to find small weaknesses, exploit them at machine speed, and run broad campaigns far quicker than traditional, human-centered defense processes can respond. The report highlights two malicious AI models—amplification （humans in the loop） and orchestration (agent-driven attacks)—and points to real incidents where AI-enabled exploits caused rapid, large-scale compromise. AI is a double-edged sword: it can power faster, more accurate defenses, but it also dramatically boosts attackers’ capabilities. Compounding the danger, cybercriminals often have stronger financial motivation and a higher return on investment for AI-enabled attacks, making them quicker to scale and monetize offensive tools than many defenders are to deploy protection. Booz Allen urges organizations to rethink timelines, run AI-focused tabletop exercises, and consider safer, faster automation for remediation—while acknowledging the operational risks of handing critical functions to AI. The takeaway: defenders must accelerate AI adoption for cyber defense, balance risk tolerance carefully, and prepare for an adversary that’s already operating at machine speed. #Cybersecurity #AI #Infosec #CyberDefense #Automation #SecurityStrategy https://lnkd.in/g2FVKw-W

22

1 Comment

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

I’m looking forward to hosting this upcoming cyber discussion with my friends and fellow graduates from the United States Air Force Academy. Cybersecurity continues to sit at the intersection of national security, technology, and industry, and it’s always energizing to connect with Falcons working across these domains. If you’re part of the USAFA network, we hope you’ll join us on March 19 for the conversation.

152

11 Comments

🚨 Texas strengthens its cyber defenses! Governor Greg Abbott announced the appointment of retired Vice Admiral TJ White as the inaugural Chief of the Texas Cyber Command — a new agency built to protect Texans from cyber threats. With decades of leadership at U.S. Fleet Cyber Command / U.S. Navy Space Command / U.S. TENTH Fleet and U.S. Cyber Command, Admiral White brings the expertise Texas needs to lead in the digital fight. This appointment is a major step forward for our state’s security and resilience. Looking forward to watching #TexasCyberCommand grow in the coming months and years. Congratulations Adminral White! Read the full announcement: https://lnkd.in/gu7BfVxa

60

2 Comments

CISA just released updated guidance for its Software Bill of Materials (SBOM) Minimum Elements, and they're looking for public comment! ✍️ This is a great opportunity to help shape the future of cybersecurity. An SBOM is a critical tool for identifying vulnerabilities and managing risks in software. Key Details: What: Updated guidance on SBOM Minimum Elements. Why: To reflect advancements in tooling and implementation since 2021. What's new: Refined data fields, automation support, and operational practices. How to contribute: Provide your feedback via the Federal Register or CISA's anonymous survey by October 3, 2025. https://lnkd.in/d58ts98t Sharing your expertise can help make SBOMs more scalable, interoperable, and comprehensive for everyone. Let's contribute to a more secure digital world! 🌎 #cybersecurity #CISA #SBOM #infosec #riskmanagement

1