Sean Doherty

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

This proposal signals a fundamental recalibration of how the United States balances security, privacy, and openness. If implemented, it could reshape global travel norms, strain diplomatic relationships, and redefine expectations for digital privacy at borders just as the U.S. prepares to host one of the world’s largest sporting events.

1

Is security enough for data protection ? Or do we need a little more ? ISMS, or information security management systems are designed to protect information, confidentiality, integrity, availability. Now, when using SFTP, the files are perfectly secure from a transfer standpoint, but, what about governance ? Audit capability ? Access control ? That's where the gap is. And yes, having an authentication bringing audit capability is also a factor in data governance. 👉 https://gag.gl/2ZxYDE #cybersecurity Kiteworks #governance #SSH #SFTP

17

5 Comments

We're excited to introduce our latest investment, Oryo.io - the security layer for agentic AI. Prashanth R. and Swaroop S., veterans of Okta and Wiz, are building agentic visibility and a trust layer on the MCP protocol for enterprise autonomous agents. Like Waymo’s cars today, agentic AI across enterprises will soon ingest data, make decisions, and take action. As adoption rises, the problem shifts from capability to control. CISOs manage identity and access for humans today. Okta anchors that trust layer for non-humans tomorrow. After our Agentic AI conference in Feb 2025 led by Anand Rao, we came with prepared minds to our first call with Oryo. Michael Marmor led diligence and is working closely with the founders as they build their MVP. We wrote the first check into Oryo. Village Global (Reid Hoffman) and Seven Hill Ventures (Michael Coates) followed soon after. Perhaps Nikesh Arora should take notice :) Venkat Raju, JB Michel, Rahul Harikumar, Quentin Staes-Polet Josh Cunningham

117

9 Comments

OpenAI & Paradigm just dropped EVMBench — and every security professional needs to pay attention. EVMBench is a new open-source benchmark evaluating AI agents' ability to detect, patch, and exploit smart contract vulnerabilities — built from 120 curated vulns across 40 real-world audits, including scenarios from Stripe's Tempo L1. This is going to accelerate blockchain security in a meaningful way. Having a standardized, reproducible framework for measuring AI capability against on-chain code is something the ecosystem has desperately needed. The data alone is already revealing: GPT-5.3-Codex scores 72.2% in exploit mode — up from 31.9% just six months ago with GPT-5. That rate of improvement is staggering. But here's what my traditional cybersecurity colleagues need to understand — because your mental model is wrong for this domain: Blockchain is not your patch-Tuesday world. In enterprise security, the lifecycle is detect → patch → deploy. You find a vuln, you push a fix, you move on. That model breaks completely with smart contracts. Most deployed contracts are immutable. Once on-chain, the code cannot be changed. No patch. No hotfix. No emergency update. The real-world attack sequence for blockchain will be: Detect → Exploit → Profit — long before any remediation is possible, if remediation is even an option. EVMBench's own results confirm the asymmetry: AI is already significantly better at exploiting contracts than detecting or patching the vulnerabilities that enable it. For legacy DeFi infrastructure securing $100B+ in assets, this has massive implications: → Contracts deployed years ago with no upgrade path now face AI-powered adversaries that didn't exist when that code was written → The cost of exploit discovery just dropped by orders of magnitude → Pre-deployment auditing alone is no longer sufficient — it needs to be continuous, adversarial, and AI-augmented → Protocols without proxy patterns, timelocks, or circuit breakers need to reassess their risk posture immediately The value EVMBench brings is giving the ecosystem a common language and measurement framework to quantify this threat and build defenses against it. This is exactly the kind of tooling that bridges the gap between AI capability research and real-world blockchain security operations. https://lnkd.in/eh29DRHy

15

This week on IT SPARC Cast – News Bytes: ✈️ UPS & FedEx Ground Planes A fatal UPS MD-11 crash forces carriers to ground entire fleets—breaking spare-part SLAs and exposing hidden enterprise supply-chain risks. 🛠️ FFmpeg Calls Out Google Open-source maintainers demand funding or relief as Google overwhelms them with fuzzing bugs. What this means for the software you rely on. 🐧 Hyper-V Used to Hide Linux Malware Hackers spin up tiny Alpine Linux VMs inside Windows to evade EDR. One of the most ingenious evasion techniques yet. ⚡ Nvidia’s Hometown Has No Power Santa Clara data centers stand empty because the city’s grid is tapped out. The AI boom is now a power problem. 💬 Listener feedback on orbital compute, AI infrastructure, and Moonraker adds humor and insight.

3

2 Comments

One of the mega trends I am most excited about is CISOs being elevated into the CIO role. It feels inevitable in a world where software is easier than ever to write but harder than ever to trust. Trust now means security, yes, but also data lineage and controls, model integrity and safety, regulatory posture, identity, and governance across humans and agents. That shifts security and trust from the periphery to the core of enterprise strategy. At the same time, the traditional CIO role has been quietly commoditized. SaaS and cloud turned much of IT into vendor management, procurement, uptime, laptops, conference rooms. In many growth companies we see the CISO running IT as a side job because identity and access matter more than ticket queues. And AI is rewriting every tool in the enterprise stack and putting every category up for grabs again. The result is that CEOs now face the largest back office technology shift in history without a truly strategic technology leader. This is the opening for CISOs. They have a chance not just to inherit the CIO title, but to remake the role into something far more relevant. Someone has to own trusted systems, AI transformation, identity architecture, and enterprise risk as a competitive advantage. Who are the best CISOs you know stepping into broader CIO or enterprise tech leadership roles and actually driving strategy, not just managing risk? Tag them. I would love to meet them. Joe Sullivan Prabhath Karanth Jeff Simon Benjamin Dulieu Sid Trivedi David Endler Amanda Robson Aman Sirohi Kris Harms Adam Ely

101

8 Comments

Empirical Security's cofounder Jay Jacobs chats EPSS, machine learning and prediction with Rafal Los. Modeling done correctly is science, not magic. You can measure it. And vulnerabilities have become a machine scale problem. A refreshing chat. https://lnkd.in/g26MaB_a

32

Airrived Emerges from Stealth with $6.1M to Introduce the Agentic OS, Defining the Agentic Era for Enterprise Security and IT Gartner-recognized platform makes agentic intelligence native across enterprise security, IT, and business operations—ending the era of experimental, bolt-on AI DUBLIN, CA – (BUSINESS WIRE (https://lnkd.in/gY9rkTFn (https://lnkd.in/gJFU5W5y) today announced its launch from stealth, backed by $6.1 million in seed funding, to bring agentic AI to the core of enterprise cybersecurity, IT, and business operations. The round was led by Cannage Capital, with participation from Plug and Play Ventures, Rebellion Ventures, and Inner Loop Capital, alongside strategic investments from cybersecurity veterans Manoj Apte, Mahendra Ramsinghani, and Saqib E. Awan. Enterprises today are constrained by fragmented agentic AI point products and legacy platforms with https://lnkd.in/gBdrapUE #msp #channelPartners #carriers #enterprise #Telecommunications #ai #messaging #mobility #ucaas #ccaas #cpaas #Mobility

9

2 Comments