Matt Singleton

𝗙𝗿𝗼𝗺 𝗣𝗿𝗶𝗻𝘁𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲 𝘁𝗼 𝗣𝗿𝗼𝗽𝗼𝗿𝘁𝗶𝗼𝗻𝗮𝘁𝗲 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲: 𝗟𝗲𝘀𝘀𝗼𝗻𝘀 𝗶𝗻 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆 𝗧𝗿𝗶𝗮𝗴𝗲 When 𝘗𝘳𝘪𝘯𝘵𝘕𝘪𝘨𝘩𝘵𝘮𝘢𝘳𝘦 dropped a few years ago, I was at Texas A&M and part of the team that led the institution-wide response. It was an “all hands on deck” moment. I stood up a real-time internal site, tracked mitigations across thousands of servers, and generated daily reports for leadership. It worked - and it set the bar. But something interesting happened afterward: Every new zero-day or vulnerability announcement triggered the same expectation. 🔥 Full crisis posture. 🔥 Executive attention. 🔥 Immediate campus-wide action. The problem - Most vulnerabilities don’t warrant that level of response. We were slipping into p͟e͟r͟m͟a͟n͟e͟n͟t͟ f͟i͟r͟e͟-a͟l͟a͟r͟m͟ m͟o͟d͟e͟. So I stepped back and asked: 𝗪𝗵𝗮𝘁 𝗳𝗮𝗰𝘁𝗼𝗿𝘀 𝗺𝗮𝗱𝗲 𝗣𝗿𝗶𝗻𝘁𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝘄𝗼𝗿𝘁𝗵 𝗮𝗻 𝗲𝗺𝗲𝗿𝗴𝗲𝗻𝗰𝘆 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲? And can we generalize those factors so we respond proportionally in the future? That question led to a matrix I built at A&M — and more recently expanded at Harvard Medical School — that evaluates new vulnerabilities across a few key dimensions: * 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆: theoretical, PoC, weaponized, actively exploited * 𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: internet-facing vs. internal systems * 𝗦𝗰𝗼𝗽𝗲: number and importance of affected systems * 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗼𝗿 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗶𝗺𝗽𝗮𝗰𝘁: HIPAA, FERPA, NIH/DoD contract implications * 𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗱𝗶𝘀𝗿𝘂𝗽𝘁𝗶𝗼𝗻/𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹𝗶𝘁𝘆 Crossing these factors produces clear, repeatable 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲 𝗟𝗲𝘃𝗲𝗹𝘀: from routine tracking to coordinated mitigation to true emergency posture. What this accomplishes: * Leaders get clarity instead of chaos * Engineers aren’t whiplashed by unnecessary escalations * Security teams focus their energy where it actually matters * External pressure doesn’t dictate internal panic * Decisions become defensible, consistent, and risk-based These are just basic, publicly available concepts that yield an important principle: 𝗠𝗮𝘁𝘂𝗿𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝗱𝗼𝗻’𝘁 𝘁𝗿𝗲𝗮𝘁 𝗲𝘃𝗲𝗿𝘆 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗹𝗶𝗸𝗲 𝗣𝗿𝗶𝗻𝘁𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲. 𝗧𝗵𝗲𝘆 𝗯𝘂𝗶𝗹𝗱 𝗮 𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝘁𝗵𝗮𝘁 𝘁𝗲𝗹𝗹𝘀 𝘁𝗵𝗲𝗺 𝘄𝗵𝗲𝗻 𝘁𝗼 𝘀𝗼𝘂𝗻𝗱 𝘁𝗵𝗲 𝗮𝗹𝗮𝗿𝗺… 𝗮𝗻𝗱 𝘄𝗵𝗲𝗻 𝗻𝗼𝘁 𝘁𝗼. It’s been a useful tool that has helped us remember, when a zero day or threat advisory comes out, we don't have to immediately call for all hands on deck. A more effective process is to take a few moments to consider the nature and impact of the vulnerability or threat, and then initiate an appropriate response. If your team ever starts drifting into “respond to everything” mode, a structured triage model might be one of the best gifts you can give them.

3

Exciting news for the Lone Star State! Texas is now providing free statewide MS-ISAC membership to over 6,000 government entities. This initiative strengthens local governments’ ability to defend against cyber threats and reinforces the importance of collaboration in cybersecurity. As part of the MS-ISAC community, members gain access to threat intelligence, best practices, and tools that help safeguard critical infrastructure. ✅ Learn more about this milestone: https://bit.ly/43yB9Ku #Cybersecurity #PublicSector #MSISAC #Texas #CyberResilience

45

1 Comment

It's great to see the state of Texas The Texas Department of Information Resources signed on for a statewide MS-ISAC membership. More than 6,000 SLTT government entities in the state will now have access to resources that help prevent, detect, and respond to cyber threats. This is what collaboration looks like—working together to make the connected world safer for everyone. https://bit.ly/43yB9Ku

22

Government agencies, like those OneNet serves, must keep their cyber defenses up-to-date, and Cybersecurity and Infrastructure Security Agency can help! CISA offers tools to help state, local, tribal & territorial governments protect our nation’s infrastructure. Read about it: https://lnkd.in/gjvnau56 #CyberAware

3

Calling all IT and IS professionals looking to advance their cyber careers. Austin Community College is offering a CISSP training class starting next week, taught by experienced professionals with extensive backgrounds in IT and cybersecurity. The course code is ACC (ITSY-1074). Key details include: - Duration: 14 sessions, Monday and Wednesday - Dates: 9 February to 1 April 2026, with a break for Spring Break - Format: Live via Zoom - Instructors: Brian Engle, Cris DeWitt, Matt Moen, and Vern Williams, each with at least 20 years of experience in IT and cybersecurity. For more information, visit https://lnkd.in/dmEQMe3a Notably, this class costs less than half as much as the cheapest CISSP class I have seen and is four times less than most online options, making it an excellent value given the instructors' expertise.

21

4 Comments

STC Cybersecurity adjunct finds national platform discussing responsible AI use Dirce Hernandez, an adjunct faculty member with South Texas College’s Cybersecurity program recently contributed to Higher Ed Risk Magazine, a national publication highlighting an urgent need for colleges to balance Artificial Intelligence (AI) with what he calls the proper guardrails regulating its use.   https://lnkd.in/e6MT5gnD

1