Evan Reiser

When you review reported breaches and incidents every day, you come across some interesting ones. Like today's gem - The Los Angeles County Museum of Art. www.hackerinahoodie.com Now you might think I find it interesting because of its breach to disclosure lag, which is pretty bad. Breached in July 2025. 7 months for their outside service provider to figure out what got stolen. 7 more months before LACMA decided to disclose it. Even better, LACMA didn't share any details in their California AG filing beyond the event. An absolute model of transparency, ammiright? Nah, what's interesting about this one is the detail shared by LACMA on their own website about this breach. "The investigation identified that the following types of personal information may have been accessed: full name, date of birth, Social Security number....health-insurance information, and limited medical information such as provider name, medical treatment, diagnosis, treatment dates, or treatment locations." I'm sorry - what? I get that this is probably employee related data, but on what planet does my employer need to hold my medical diagnosis and treatment dates? It would have been safer if they framed these and put them on the wall. LACMA's own website page linked in the comments, because The Hacker In A Hoodie rule is only what the data proves.

10

6 Comments

30% of all global enterprise email is secured by one company: Proofpoint. In August 2021, Thoma Bravo took Proofpoint private for $12.3B - the largest cloud buyout ever - ushering in a new era of PE-backed cyber M&A. Four years later, Ross, Mahendra, and I sat down with Proofpoint CEO Sumit Dhawan on Inside the Network to talk about his journey and how he’s expanding beyond Proofpoint’s dominant position in email security. Here are three takeaways from our conversation: 1) Act like an owner - no matter your role. Ownership mindset matters. Whether you’re a manager or a CEO, treating the business as your own builds trust with boards, investors, and employees. It shows you’ll put the company’s long-term interests above personal gain. 2) Big goals require ruthless focus. Sumit’s “5 by 30” vision - growing Proofpoint to $5B in revenue by 2030 - means doubling revenue yet again (from $1.2B when it went private to $2B today). To get there, he’s focusing on two core pillars: collaboration security and data security. World-class execution in fewer categories beats mediocrity in many. 3) Generative AI is fueling intent-based attacks. Attackers are using LLMs to craft messages with no links or attachments - just context and wording designed to trick recipients. Proofpoint is countering this shift with LLM-powered intent detection models, restoring the ability to catch threats that look “normal” on the surface. This episode delivers practical, hard-earned advice for founders, CEOs, and operators - especially those navigating AI, platform shifts, and scaling with purpose. Apple Podcast: https://lnkd.in/gahmsxyF Spotify: https://lnkd.in/gUgGqUz8 Podcast Website: https://lnkd.in/gRR-Vk5w

130

11 Comments

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment