Justin Somaini

I'd like to think that people would recognize an obvious point here. Safe, which relies on FAIR analytics, was miles ahead of even the other CRQ leaders in Forrester's analysis (and Safe isn't the only FAIR-based player in the market). If this doesn't blow a great big gaping hole in ridiculous claims that FAIR is somehow irrelevant in 2025, I don't know what will. Unfortunately, many of these claims about FAIR are driven by one of two things -- 1) ignorance, or 2) misinformation for competitive messaging. As far as ignorance goes, very often that's simply a mistaken belief that FAIR is dependent on SME estimates and/or relies solely on betaPERT distributions. Neither is true. If you have empirical data, FAIR can consume it. If you want to use a different distribution, FAIR's fine with that too. FAIR is a model, folks. It defines factors and their relationships -- period. As such, there are many ways to implement it, each with its strengths and weaknesses. Furthermore, FAIR describes how risk works, which doesn't change as the risk landscape changes. Yes, the details of the risk landscape (e.g., threats, assets, controls, etc.) change over time, but how RISK works (and therefore FAIR) is resilient to these changes. Think of this as being similar to Copernicus' observations of the solar system -- elliptical orbits, etc. Those observations describe how the solar system appears to behave. You may discover (or remove) planets but the nature of the system remains unchanged. I'm excited for my friends at Safe, who have worked very hard to get the product to where it is. But let's also recognize that CRQ is still largely thought of as a nice-to-have, and we're only going to overcome that by educating the market and raising risk measurement expectations, and not through misrepresentations.

116

11 Comments

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

Exploitation timelines are increasingly measured in days rather than weeks. Our latest report from Rapid7 Labs correlates vulnerability publication data, confirmed exploitation trends, frontline MDR incident response telemetry, and dark web, cybercrime, and nation-state intelligence to provide a unified view of how exposure evolves into compromise. One of the biggest standouts: how rapidly AI is being integrated into attacker playbooks, accelerating the operationalization of exposure. Many of the incidents we investigate still originate from known, unaddressed exposure. In those cases, attackers don’t need sophistication - they need opportunity. As remediation windows shrink, reducing that opportunity becomes essential to limiting compromise. You can download the 2026 Global Threat Landscape report here: https://r-7.co/4bQOAtq #infosec #cybersecurity

37

1 Comment

I have seen firms depend heavily on vendor promises without ever asking for proof. That’s a dangerous degree of trust. Regulators expect written documentation and monitored compliance. At itSynergy, we help RIAs enforce the 72-hour notification requirement. #VendorRisk #RegSP #RIACompliance

3

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

Another publication for an already productive 2025. Yesterday NIST released a quick start guide on the concept of using the CSF to make some decisions on emerging risk. We often talk about maintaining an eye to the future of cybersecurity risks while also preparing for an "uh oh" surprise. I think this document has a little help for both camps. Of course, the comment period is open and we are always looking for your experience in this field.

10

1 Comment

Start treating contracts as part of your compliance infrastructure Compliance teams spent most of last year operating in a regulatory gray zone. AI moved into core business workflows faster than rulemaking could keep up. Expectations still existed. Scrutiny increased. Enforcement risk didn’t wait for the dust to settle. Organizations needed a way to operationalize compliance even when the benchmarks were incomplete. Contracts became the mechanism that filled the gap. Read the full article: https://lnkd.in/g6H-qXCv This piece examines how contracts shifted from risk-allocation tools to active compliance infrastructure. The pattern showed up everywhere in 2025 and is accelerating in 2026. Instead of relying on high-level promises, agreements are starting to encode governance roles, review cycles, monitoring expectations, escalation paths, verification rights, and documentation requirements. In practice, this becomes the evidence trail regulators will expect to see when oversight arrives. The change is quiet but meaningful. Compliance programs still need policies and controls, but the contract is now the part that regulators can inspect externally. It’s the clearest record of what the organization understood its obligations to be at the time it made decisions. It also shows whether the company tied its assurances to real processes or relied on generic language that doesn’t hold up under inquiry. Audit rights are taking on a new role as well. They are no longer back-end enforcement tools. Their presence shapes how vendors govern their systems day to day. They create visibility and accountability even when they aren’t exercised. The same goes for governance language moving into the core agreement instead of the appendix. It’s becoming a primary indicator of compliance maturity. If you work in compliance or partner with your legal team, this matters. Contract language now influences not just commercial outcomes but your ability to demonstrate diligence, readiness, and control. Alignment between contracts and your internal compliance framework is no longer optional. It’s essential to operational credibility. For more insights, see the Contract Trust Report: https://lnkd.in/gJdXkUpJ — Olga V. Mack I build legal systems for real life.

57

17 Comments

The California Privacy Protection Agency has opened up a new position -- a Research Technologist to help facilitate audits of businesses covered under the CCPA. https://lnkd.in/gsBE-Ses

55

2 Comments

Compromise usually starts quietly in someone else's environment long before any impact is visible internally. Despite this reality, many Third-Party Risk Management (TPRM) programs remain stuck in a compliance-first mindset. Relying on static vendor lists and annual questionnaires creates the appearance of control but fails to address active threats. The real challenge is not vendor volume but the lack of intelligence connecting vendor risk to real-world attacker behavior. Effective defense requires a shift to Risk-Aware Prioritization. By combining ecosystem relevance with real-time threat signals from Dark Web marketplaces and hacker forums, security teams can identify high-risk vendors before a breach spreads. This approach moves TPRM from a documentation exercise to an operational security function that detects exposure weeks before public disclosure. Read more: https://lnkd.in/gesYx5jH #TPRM #SupplyChainSecurity #CyberSecurity #VendorRisk #SOCRadar

5

Cyberattacks are getting smarter. Are your defenses keeping up? AI can help you: * Spot threats in real time * Predict risks before they spread * Cut through alert noise * Respond faster * Meet compliance needs But tools alone aren’t enough. You need the right strategy. See how AI + expert guidance can improve your cybersecurity. Read the full post: https://hubs.la/Q03szv3J0 #Cybersecurity #AI #ArtificialIntelligence #Compliance

20

Strengthen Your Internal PCI Program with Expert Guidance Your internal compliance team deserves more than generic checklists. Building a robust internal PCI compliance program requires specialized expertise and ongoing support. The most successful organizations don't go it alone—they partner with trusted advisors who understand both compliance requirements and business realities. Why Partner with PCI Compliance Experts? 🎯 Deep Expertise at Your Fingertips Access unmatched assessment experience directly for your internal team. Your compliance professionals gain insights that only come from conducting thousands of assessments across diverse environments. 💪 Empowering Your Team Rather than replacing your internal capabilities, expert partners enhance them. Working alongside your compliance team to build processes, refine procedures, and develop the institutional knowledge that makes your program truly self-sustaining. 🧭 Guidance When You Need It Complex interpretations, evolving requirements, remediation strategies—your internal team gets expert consultation precisely when challenges arise. Keep your program on track without constant hand-holding. 📈 Long-Term Cost Efficiency Building internal expertise from scratch is expensive and time-consuming. An advisory approach delivers immediate access to specialized knowledge while developing your team's capabilities over time, reducing total cost of compliance while improving program maturity. The Bottom Line: Your internal compliance team has the passion and organizational knowledge. Strategic partnerships provide the specialized expertise and advisory support to make them unstoppable. When your team faces complex compliance challenges, they shouldn't navigate alone. When stakeholders demand answers, your team should have expert backing. Ready to strengthen your internal PCI program? Let's discuss how Coalfire's advisory services can transform your compliance outcomes and build lasting organizational confidence. What's been your biggest challenge in building internal PCI compliance capabilities? Share your experience below. 👇 #PCICompliance #CyberSecurity #RiskManagement #ComplianceStrategy #InfoSec

17

Sergio Albea's article on Detect FYI does a great job of clarifying what we often conflate: IoCs, IoAs, and fraud indicators and why each demands a different response. IoCs tell us what already happened, IoAs alert us to active threats in progress, and fraud markers point to behavior anomalies worth addressing before damage is done. In my work building SOCs for Fortune-level enterprises, I’ve seen the shift toward IoA-first detection not just more efficient, but game-changing for threat hunting. It’s about catching intent, not just aftermath. How is your team balancing forensic signals with behavioral early warnings in your hunt? Article: https://lnkd.in/gygQs6FN #Cybersecurity #ThreatHunting #DetectionEngineering #SOC #Leadership

15