Rachel Tobac

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

The California Privacy Protection Agency has opened up a new position -- a Research Technologist to help facilitate audits of businesses covered under the CCPA. https://lnkd.in/gsBE-Ses

55

2 Comments

Workplace Safety in San Jose offices starts before a situation becomes a crisis. When language shifts from frustration to threats or ultimatums, the best corporate risk programs follow a process. The CALM Framework: Contain the moment • Assess the risk • Log facts • Manage next steps Then move into Threat Assessment + Threat Management: Evaluate what happened • apply clear escalation thresholds • follow up so it doesn’t repeat. What other procedures do you think should be in place when it comes to a safer corporate environment? #WorkplaceSafety #WorkplaceViolencePrevention #ThreatAssessment #RiskManagement #CorporateSecurity #SecurityOperations #SanJose #SiliconValley #VCPG

6

Insider risk resources are often scarce, and many large organizations, such as Google, tend to address these issues only after well-publicized incidents. -https://lnkd.in/gxyAny7a. Marshall Heilman and the folks from DTEX partnered with the Ponemon Institute to release the "Cost of Insider Risk 2026 Global Report" - https://ponemon.dtex.ai/. This report is the gold standard in providing trends to evaluate and budget for your own Insider Risk program. Share it with your chronically underappreciated Insider Risk folks Key Insights - Total average annual cost of insider security incidents is US$19.5M - Companies with an insider risk management program save themselves from 7 incidents a year, saving on average 8.2 million dollars - Time to Containment is reduced with a commitment to budgeting for Insider Risk, with an average of 67 DAYS to contain, down from 86 in 2023 - They address the rising COST OF SHADOW AI with cost of $10.3M due to negligent insiders

19

I knew the COTS vulnerability management space was getting tough, but I didn’t realize it was THIS bad. By my calculations, the typical vuln management program can only reach 18% of exploited vulnerabilities. This is mostly due to the speed of exploitation, but partially due to poor asset management as well. The speed of CVE publishing and enrichment is an issue as well. Faster exploitation causes a lot of issues. Lots more details in the full post. In comments below.

27

20 Comments

Cyberattacks are getting smarter. Are your defenses keeping up? AI can help you: * Spot threats in real time * Predict risks before they spread * Cut through alert noise * Respond faster * Meet compliance needs But tools alone aren’t enough. You need the right strategy. See how AI + expert guidance can improve your cybersecurity. Read the full post: https://hubs.la/Q03szv3J0 #Cybersecurity #AI #ArtificialIntelligence #Compliance

20

🚩Threat actors exploit available information to piece together a target’s profile, monitor their activity, and plan harassment, online targeting, stalking, or in-person attacks. It has been reported in court documents that the suspect in the Minnesota shooting had used people search sites and data brokers (such as BeenVerified, USSearch, Intelius, and TruePeopleSearch) to access personal information for the individuals on his target list. Incidents like this demonstrate how publicly available personal information can be leveraged by threat actors to enable targeted threats. 🔎 A just-published Nisos study found that 98% of executives have a property linked to their name in public records or people search sites, with 92% of those properties having viewable exterior images. 💥In our digital world, accessing personal information such as home addresses, phone numbers, family connections, and property records are just a few clicks away through digital broker sites, people search platforms, and public records. For executives, public figures, and high-risk individuals, this isn’t just a privacy concern -  it’s a security risk. The unfortunate reality is many executives and public figures do not have clarity into how much of their personal information is accessible online.  While personal information will always exist in some capacity via public records, there are steps that individuals and organizations can take to reduce risk. These include: 📍Identifying exposed information 📍Requesting removal from high-risk platforms (manual efforts are critical) 📍Adjusting privacy setting 📍Actively monitoring for signs of emerging threats 💡 We have seen firsthand how these digital exposures translate to real-world threats. That’s why we put together our Executive Vulnerabilities Report - to help security leaders, protective intelligence teams, and executives themselves understand where exposures exist and how to proactively reduce their risk. https://lnkd.in/e_dfGbpE

58

1 Comment