Justin Somaini

Vulnerability management shouldn’t feel like drinking from a fire hose. 🚒 In a recent N2K | CyberWire episode with Dave Bittner, Horizon3.ai CEO Snehal Antani unpacked one of the most persistent challenges security teams face: too much noise, not enough signal. When every scanner reports tens of thousands of “critical” vulnerabilities, the real work becomes deciding what not to fix — and how to prove which issues actually matter before asking teams to sacrifice weekends and family time. In the episode, Snehal draws on his experience as a CIO, CTO, and leader within U.S. Special Operations to explain why modern defense has to move beyond lists and checkboxes, including: • Why vulnerability scanners show what might be wrong, but pentests show what’s actually exploitable • How attackers chain misconfigurations, credentials, and access paths in ways tools rarely model • What boards really need to understand risk: clear consequences, not heat maps • Why “patching everything” isn’t a strategy — and never was • How continuous, attacker-centric testing builds real cyber resilience The takeaway is simple: defenders think in lists; attackers think in graphs. If you’re not testing from the attacker’s perspective, you’re guessing. 🎧 Listen to the full CyberWire-X episode here: https://lnkd.in/graZwP89. #OffensiveSecurity #pentesting #infosec

29

🟧 Webinar with Okta on Jan. 22: Creating a Unified View of Identity Risk Enterprises manage various identities with differing risks. Disconnected tools hinder policy enforcement and attack response. An identity security fabric unifies visibility, standardizes controls, and automates responses across all identities and systems. 🎯 Join Arkadiusz Krowczynski and Alejandro Leal to: • Understand why identity is now the primary security control plane—and the primary attack vector • Learn how an identity security fabric unifies tools, workflows, and policies across environments • Discover how to eliminate visibility gaps and identity silos • See how orchestration automates and accelerates threat response • Explore practical steps for securing users, workloads, and AI agents • Learn from KuppingerCole’s research and Okta’s implementation expertise Register: https://okt.to/JBmofH #IdentityRisk #IdentitySecurity #IdentityFabric

7

When investigations lack forensic clarity, the impact goes beyond response time. It hits breach costs, regulatory reporting, and executive confidence. 📉 $1.1M average cost per breach ⚠️ 68% of CISOs admit inaccuracies in regulatory reporting Our latest CISO report breaks down why this happens and how leading teams are closing the investigation gap with faster, evidence-backed decisions. 👉 Download the report (free) https://bit.ly/4bJ4fLM #CISO #CyberResilience #IncidentResponse #RegulatoryReporting #SecurityLeadership

11

In my experience, it doesn’t matter what you do with your Trust Center or if you have a SOC 2, you still get a questionnaire. We’ve tested with and without NDA. You still get a questionnaire. We’ve tested with extensive FAQs. You still get a questionnaire. Best case is your customer / prospect tailors the questionnaire to what’s on your trust center. But, you still get a questionnaire.

30

8 Comments

Traditional security architecture reviews don't scale. As systems grow more complex and development accelerates, security teams become bottlenecks. At Box, we're building security architecture for agentic development. Our automated STRIDE threat modeling agent analyzes designs in minutes, producing machine-readable security intelligence that flows directly into coding agents, review agents, and testing tools. The shift:  → Late-stage reviews to early design engagement → Static documents to living security input → Bottlenecked expertise to scalable capability AI handles routine analysis at scale. Human architects focus on complex problems requiring judgment and adversarial thinking. Read more: https://lnkd.in/gy8iNGdi

9

In critical infrastructure, “which diode?” is often the first real question, not “do we need one?” OPSWAT makes that decision easier by mapping requirements to options without oversimplifying the risk tradeoffs.

17

Why did the MacArthur Foundation move to a continuous penetration testing model? In this #AoB clip, Seth Arnoff shares two very practical reasons: 🔹 Security visibility year-round Instead of a once-a-year snapshot, continuous testing provides an ongoing view of security health - test, remediate, verify, and repeat. 🔹 Operational efficiency for lean teams With a smaller security staff, managing traditional pentests can be time-consuming. Continuous pentesting reduces back-and-forth, runs largely on its own, and surfaces changes only when attention is needed. The takeaway is simple: better coverage, verified remediation, and less operational overhead. Watch the episode: https://lnkd.in/e2jfU8A8 #OffensiveSecurity #ContinuousPentesting #CyberSecurity #PenTesting #SecurityLeadership #CISO #AheadOfTheBreach #MacArthurFoundation

9

1 Comment

NIST SSDF v1.2 (Initial Public Draft, Dec 2025) is a surgical but meaningful evolution of v1.1 (Feb 2022): two new practices shift the framework from “secure SDLC controls” toward “secure SDLC controls + operational resilience + continuous adaptation”. What materially changes: 1. Continuous process improvement becomes first-class (PO.6). SSDF now explicitly requires a closed feedback loop that continuously upgrades dev environments, tools, techniques, and vuln response based on new threats, incidents, and ecosystem changes (e.g., adding/updating artifact scanning for supplier inputs, improving audit/logging granularity for reconstruction, adopting safer languages/features to eliminate entire bug classes). Technically: this turns SSDF into a living control system (think: DevSecOps telemetry - detection/lessons learned - pipeline/toolchain hardening - measurable KPIs/KRIs), not a static checklist. 2. Update robustness and reliability is now explicit (PS.4). SSDF elevates safe delivery of software updates into its own practice: testing in customer-like environments, tiered rollout strategies, rollback mechanisms and resilient update infrastructure while emphasizing minimizing disruption and enabling customer control over updates/configurations. This bridges secure development with release engineering/SRE realities treating updates as a high-risk attack surface and a reliability event stream, not just “patch when vulnerable.”   #NIST #SSDF v1.2 implicitly says: “Secure software is not only what you build, it’s how fast and safely you can change it, continuously”.

5

3 Comments

The next critical CVE isn't a question of if, but when. Will your team be running a war room with 13 different teams frantically debugging permission issues across dozens of clusters? Or will you run a single query against your SBOM inventory and let your policy engine handle remediation recommendations? Learn how Anchore Enterprise transforms CVE response in our latest article. 🔗 https://lnkd.in/etSgZw2K #SBOM #VulnerabilityManagement #SupplyChainSecurity #DevSecOps

3

If your audit prep still relies on static controls and outdated playbooks, it’s time to adapt. HITRUST’s adaptive assessments (e1 and i1) are grounded in real breach data and threat intelligence—so you’re aligning your controls to what actually happens in the wild. This is what real resilience looks like. #SecurityFrameworks #HITRUST #AuditReadiness #AdaptiveSecurity #RiskMitigation

7

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

144

11 Comments

New article on PCA Cyber Security blog: “PCI PTS Compliance: A Necessary Step, But Not the Full Story.” PCI PIN Transaction Security (PTS) compliance ensures payment devices meet baseline tamper-resistance and encryption standards - a must for protecting PINs and transaction data. But as we explain in the article, certification alone doesn’t guarantee security across the full payment solution - backend systems, firmware, communication channels, integrations and real-world attack vectors still matter. 💡 If you’re building or securing payment terminals, ATMs, or other transaction systems, this article breaks down why compliance should be the start, not the finish line. 👉 Read more: https://lnkd.in/dGmDK7vD #PCI #PCICompliance #PaymentSecurity #EmbeddedSecurity #CyberSecurity #PTS #RiskManagement

8

Your security contractor says compliance is at 98%. Your actual audit results tell a different story. I've observed this pattern repeatedly: organizations rely on vendor self-reporting for security performance metrics, only to discover significant gaps during independent assessments. The challenge isn't dishonesty - it's perspective. Contractors naturally view their performance through the lens of effort and intent. But compliance requires measurable outcomes aligned with your specific risk tolerance and contractual obligations. Independent oversight creates accountability without vendor conflict. It validates that your security investments deliver the protection you're paying for, not just the protection they think you need. When performance visibility becomes vendor-neutral, compliance becomes measurable. GreyShield Group provides intelligence-driven oversight that ensures contractual alignment. Contact us at intelligence@greyshieldgroup.com #VendorOversight #ThirdPartyRisk #SecurityOperations #ContractCompliance

3