Booz Allen Hamilton

The hardest question in cybersecurity this week was not "Are we patched?" It was "Where is PHP running?" Yesterday, two critical flaws in PHP were disclosed. PHP runs roughly 7 in 10 websites, and attackers were probing four days before a patch existed. Authorities in the US, UK, and Europe then told every organization, not just government agencies, to patch immediately or take vulnerable systems offline. Credit to Wiz and OpenAI for finding and reporting these flaws. Responsible discovery is what gives defenders a fighting chance. What I am hearing from dozens of CISOs today, and seeing in Booz Allen Hamilton threat hunting intelligence: ▶️ Time to find matters more than time to patch. The fix was ready in hours. Finding every place it needed to go is taking much more time. Exposed PHP sits in vendor portals and even some security tools. Once you know where PHP runs, determine which systems sit in an attacker's path and fix those first. ▶️ The off switch needs an owner. Organizations had hours to decide whether to take customer-facing services down, and few had agreed in advance who makes that call. Decide now which systems can go dark, who approves it, and what an hour of downtime costs. For critical systems that cannot be patched at all, that decision belongs with executive leadership. ▶️ AI is shrinking defenders' head start. Code that sat untouched for a decade became a working exploit with AI's help, and attackers moved before the fix shipped. A patched system is not necessarily a clean one, so look for signs of compromise. Within 24 hours, our own incident response team was already responding to possible compromises. The question for every executive this week: how long would it take us to find every system that needs the fix? Our full threat intelligence brief is below. #Cybersecurity #BoardGovernance #ThreatIntelligence #AI #PHP Kraig Rutland David Faraone Scott Walters Emily Helmke

Buying a company is the easy part. After eight integrations and a leadership team that never stayed the same, here are the five principles that kept us performing, and why they matter now that AI has every team integrating something new. #Leadership #MergersAndAcquisitions #ChangeManagement #AI

As a former CISO, I read AI threat research the way I read the warning lights on my car. I don't ignore the low fuel light. It tells me how bad the situation is, how far I can go, and exactly what to do. The check engine light is different. Something is wrong. Some people drive for months with that light glowing. Not because they doubt it. Because there is no immediate consequence to ignoring it and nothing specific to do about it. Last week Booz Allen Hamilton published research measuring what AI models can do inside a live enterprise network. While many CISOs appreciated the insights, a few told me it read as fearmongering. I take that seriously, though not in the way you might expect. The findings are the findings. We tested 18 models against a production-grade environment and reported what happened. What interests me is the reaction, because I had it for years on the other side of the table, and there is good research that explains it. People read a threat message on two channels: how bad it is, and whether they can do anything about it. When the threat outruns the fix, the reader manages the feeling instead of the risk, and the cheapest relief is deciding the check engine light is probably nothing. Most threat research is a check engine light, which is not a criticism, but the gauge is the part I want to talk about. The result that deserves attention is not that a frontier model completed a kill chain. It is that a model near the bottom of the index performed like the model at the top once it was given a harness. The scaffolding was the variable, not the intelligence. And in the successful runs, the models did not invent a way in. They used credentials and paths that were already sitting there. So here is the action every CISO can take right now. Count the identities that can reach domain admin, or tier-0 equivalent, within three steps. Include service accounts and every agent deployed this year, because a harness is a privileged identity. Then count how many of those have no accountable owner: a named person who granted the access, keeps its use in bounds, and can revoke it. That is your exposure to an autonomous attacker, and to a competent human one. The models we tested did not invent authority. They borrowed what was already granted. Cut that number this quarter. It moves risk more than rankings do. Now the question for CISOs: what would have to be in an AI research report for it to read as a fuel gauge rather than a check engine light? #boozallen #cyber #AI #ciso Emily Helmke, Scott Walters, Ben Denkers, Rosetta Jones, Justin Domachowski, Anthony DiFuria, Nicole Monteforte https://lnkd.in/ewQrRuEw

Hi %FIRSTNAME%, I hope you're as excited as I am about the new year and all its possibilities. I'm a recruiter at Booz Allen, and we're looking for cleared tech talent to join our teams. If you're ready to push boundaries and dive into next-gen tech, let’s chat. Imagine working on exciting initiatives like accelerating cutting-edge digital solutions, powering zero trust security, and building innovative solutions like Space Llama 🦙 and AI-powered wearables for today's warfighter. Our missions aren't just impactful—they ‘re game-changing, and we’re eager for talented individuals like you to help shape the future with us. If you’d like to learn more, connect with me and explore our open opportunities. Kind regards, Zach K.

Our VR technology teaches sailors how to fix unmanned underwater vehicles without touching real equipment—saving time and protecting critical assets.