LinkedIn thought leader ad examples

If you think your LLM makes your code secure, you’ve already lost. Code generation isn’t code security. Understanding risk and context is. That’s the difference Code Security Intelligence makes. I wrote this blog post to draw a clear line between using LLMs for security vs. assuming LLMs are security. At DryRun, we use advanced LLMs as part of our Code Security Intelligence solution which orchestrates our code review agents much like a human reviewer. LLMs can help understand code, patterns, and intent, but context, policy, and risk analysis require more than a base frontier model can provide. The post explains why relying solely on your coding assistant for security is a category error and how true AppSec intelligence uses AI to reason about code the way a seasoned security engineer would. Check out the post or hit me up if you want to chat about AI and security! https://lnkd.in/gEBaXvwp

Are you looking for an AI-native approach to SAST? It can be challenging to determine the efficacy of tools, and it's difficult to discern from marketing sites which tools are AI-native versus those that incorporate AI into a legacy, regex-based approach. Don't worry, I've got you covered. We realized that not all SAST tools are created equal—accuracy (i.e., finding true vulnerabilities without swamping teams with false positives) is the key differentiator. We created the 2025 SAST Accuracy Report ( 🔗 link to report in the comments) This report compares the accuracy of five prominent tools—DryRun Security, Semgrep, Snyk Code, GitHub Advanced Security (CodeQL), and SonarQube / SonarCloud. The comparison is based on head-to-head public tests in Ruby, Python, C#, and Java. The report findings demonstrate how these solutions address both traditional application security issues and more complex logic flaws such as IDOR, BOLA, and business-logic errors. All of the tested tools advertise AI-augmented capabilities, but only DryRun Security provides an AI-native approach to detection. Check the comments for a link to the full, ungated report.

‘Basis security’ is nooit genoeg. Criminelen houden het ook niet bij de basis, zij proberen altijd weer een nieuwe ingang te vinden. Wat ik daarom zo mooi vind aan onze samenwerking met Online Payment Platform: CEO Maurice Jongmans gaat niet voor compliance, maar voor échte weerbaarheid. OPP moet haar klanten kunnen geruststellen dat hun betalingen veilig plaatsvinden. Cybersecurity is dus niet alleen voor OPP zelf van belang, vertrouwen ís het product. OPP had haar fundament al op orde. Maar dat was niet het doel. Ze wilden beter worden. Aantoonbaar veiliger. Niet alleen: “De basis ligt er, dus we zullen wel veilig zijn”, Maar: “We kunnen aantonen dat we veilig zijn en we blijven continu verbeteren”. Wat we samen hebben gedaan (en blijven doen): - systemen door en door testen - mensen meenemen in bewustwording - en vooral: cybersecurity meenemen in de bedrijfsvoering Zo is security niet een verplichting die je afvinkt, maar iets waar je als bestuurder actief mee bezig bent. Bedankt Maurice, voor het mooie interview en de fijne samenwerking!

Je zou verwachten dat elke organisatie scherp heeft welke assets écht kritiek zijn. Maar in de praktijk valt dat vaak tegen. Ik spreek nog regelmatig bedrijven die precies weten wat ze verkopen, maar niet helder hebben welke processen daarvoor onmisbaar zijn. → Welke stappen in je organisatie móeten blijven draaien om überhaupt te kunnen leveren? → Welke data kun je niet missen? Waar zit je grootste afhankelijkheid? Als dat niet duidelijk is, wordt het ook lastig om keuzes te maken. Waar leg je de focus op, welke maatregelen zijn er nodig? Zonder basis kom je hier niet uit met de board. Dus, ga eerst inventariseren. Écht begrijpen hoe je organisatie werkt. Pas als je weet wat kritiek is en wat niet, heeft het zin om te praten over maatregelen.

Procurement has a serious PR problem. For years, I've seen procurement teams misunderstood. The perception is simple: procurement is a cost-cutter. But the reality is that procurement is an 𝘪𝘯𝘯𝘰𝘷𝘢𝘵𝘪𝘰𝘯 𝘦𝘯𝘢𝘣𝘭𝘦𝘳. When I speak with leaders, I often hear frustration about complicated processes, endless reviews, and the feeling that procurement slows the business down. But I think that misses the first principles of why this function exists. Procurement isn't just around to get vendors in and get them paid…they exist to help companies 𝗮𝗱𝗼𝗽𝘁 𝗶𝗻𝗻𝗼𝘃𝗮𝘁𝗶𝗼𝗻 faster, and more safely. This misunderstanding shows up everywhere: 🚫 Executives undervalue procurement's seat at the table 🚫 Teams avoid looping them in until it's too late 🚫 Procurement gets measured only on savings But the real ROI of procurement is much bigger: ✅ Faster access to the best tools that drive growth ✅ Safer adoption of vendors in a world of rising risk ✅ More leverage for every dollar a company spends externally The fix here isn't just about improving workflows or adopting new technology. It starts with changing the narrative. Procurement isn't overhead, and it isn't a blocker. It's the function that determines how quickly and how safely a company can bring the outside world in. That's becoming the difference between those that fall behind and those that move ahead. — 👋 I'm Clarence. I help companies with procurement and vendor risk at Coverbase. ♻ Share if procurement bottlenecks are killing your velocity. 💬 DM me if you want to onboard vendors in days, not months. #Procurement #SustainableProcurement #DigitalTransformation

Your AI model doesn't matter if you can't detect when it's wrong. We built Coverbase to automate procurement and vendor risk workflows using AI. Our systems read 300-page documents and evaluate vendors, contracts, and compliance requirements. But here's something that might surprise you: Every AI company today builds on similar infrastructure foundation models. OpenAI's GPT, Meta's Llama, Google's Gemini. We all use the best models. Yet some companies ship products that work reliably while others 𝗰𝗼𝗻𝘀𝘁𝗮𝗻𝘁𝗹𝘆 𝗳𝗮𝗶𝗹. IMO, it's b/c most AI companies obsess over the wrong thing. They fine-tune models endlessly, add more training data, and chase higher accuracy scores. But none of that matters if you can't trust the outputs. The companies winning with AI build something different: ✅ 𝗖𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝗰𝗲 𝘀𝗰𝗼𝗿𝗶𝗻𝗴. "This assessment is only 60% certain" ✅ 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰 𝗲𝘀𝗰𝗮𝗹𝗮𝘁𝗶𝗼𝗻. Low confidence triggers human review ✅ 𝗖𝗼𝗻𝘁𝗿𝗮𝗱𝗶𝗰𝘁𝗶𝗼𝗻 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻. AI spots its own inconsistencies ✅ 𝗙𝗲𝗲𝗱𝗯𝗮𝗰𝗸 𝗹𝗼𝗼𝗽𝘀. Every correction improves future assessments ✅ 𝗖𝗹𝗲𝗮𝗿 𝗹𝗶𝗺𝗶𝘁𝗮𝘁𝗶𝗼𝗻𝘀. AI knows what it can't evaluate Look, AI 𝘞𝘐𝘓𝘓 make mistakes. No model is perfect. The major difference is that when our AI isn't sure about a procurement decision, it says so. That assessment gets flagged for human review before any decision is final. Good AI but 𝗲𝘅𝗰𝗲𝗹𝗹𝗲𝗻𝘁 𝗲𝗿𝗿𝗼𝗿 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 > cutting-edge models w/ no safety nets. When you build infrastructure that catches mistakes, procurement teams actually trust your automated decisions. Support tickets drop because the system catches errors before users see them. But the model is useless without trust. What do you think? — 👋 I'm Clarence. I help companies with procurement at Coverbase. ♻ Share if procurement bottlenecks are killing your velocity. 💬 DM me if you want to onboard vendors in days, not months. #Procurement

The Browser War 2.0 Has Begun — And It’s All About AI Dia (by The Browser Company), Comet (by Perplexity), Island (by Island). And now Atlas OpenAI’s own browser. The next generation of browsers isn’t just about speed or design. They’re becoming AI-native platforms — where every search, chat, workflow, and decision is powered by large language models. This shift is monumental. But it also means one thing: Your sensitive data customer PII, internal IP, source code, financials — is flowing directly into AI systems at the edge of your enterprise and it getting available to the whole world which uses these public SAAS Gen AI applications. That’s where Concentric AI’s GenAI Data Security Browser Extension steps in. 🛡️ Secure Every Prompt. Protect Every Interaction. As the AI revolution meets the browser revolution, Concentric AI provides: Real-time data classification and protection — before sensitive data ever leaves the browser. AI-aware DLP and policy enforcement, integrated directly into Chromium-based browsers along with others. Seamless compatibility across the new generation of AI browsers including Atlas, Comet, Island, Chrome and others. Complete visibility and governance With a single lightweight browser extension, enterprises can now embrace AI productivity safely — without losing control of their data. 🌍 The Future of AI Security Is at the Edge As browsers become the new AI operating systems, data security must move with them closer to where users think, chat, and create. The boundary between “browser” and “AI agent” is blurring fast — and Concentric AI is redefining how we protect that boundary. AI-native. Browser-first. Data-secure. That’s the future we’re building. The AI browser era has arrived. Data security needs to evolve with it. #GenAI #Cybersecurity #BrowserSecurity #DataProtection #LLM #AIRevolution #ConcentricAI #SwiftSecurity #ZeroTrust

Today, we launched our 2025 Unit 42 Global Incident Response Report. Inside this 38-page report you’ll find key trends that businesses need to be aware of to defend against cybercrime: intentional business disruption, increasing attack speed, insider threats, cloud and supply chain attacks, AI-assisted attacks and more… And we dive into the common mistakes we see when we’re responding: overly complex environments, gaps in visibility, too much trust. But what you won’t see in the report is the relentless work behind these insights. Our Palo Alto Networks Unit 42 Incident Response team operates 24/7, 365 days a year responding to attacks in real time. When a client calls, we don’t hesitate. We drop everything, and in many cases fly across the country or even the world, to help them recover as quickly as possible. The trends in this report are critical, but so is the team behind them. I’m proud of their dedication and the impact we continue to make. More thoughts on these trends coming soon. For now, enjoy diving into the full report here: https://lnkd.in/gziuzCNP Wendi Whitmore Michael Sikorski Tim Erridge Philippa Cogswell André Reichow-Prehn Sankara Shanmugam Daniel Sergile Brock Bell Christi M. Donnie Tindall Erica Naone Dan O'Day Alfred Sivathondan Christopher Scott Matt Armstrong Ross W. Preston Miller Mike Savitz 🔍 Adrian Taylor Chris George Eric Semaan Roland Eid Helen Teixeira Stefan Vömel Nicolas Koller Ruben C. Aditi Adya Jim Barber Richard Emerson Evan Gordenker Michael J. Graven Eva Dudzik Mehlert Lysa Myers Prashil P. Laury R. R. Doel Santos Samantha Stallings Jamie Williams ..and many more

Generative AI is reshaping how businesses operate, how we work, and even how society functions. It’s the buzzword of the moment—surrounded by equal parts hype and FUD. Yet one critical dimension often gets overlooked: data security. In our new white paper, Lane Sullivan and I unpack why GenAI differs fundamentally from past waves of AI innovation, how it can amplify data security risks *even when it's working as designed*, and what leaders can do to protect their organizations. Give it a read and share your thoughts—how is your organization approaching data security in the age of GenAI? #GenAI #DataSecurity #DataSecurityGovernance #AISecurity https://lnkd.in/gmKmSbxY

Attributing a cyber incident is a critical, high-stakes process focused on identifying a threat and understanding the motivation, capability, and intent behind the attack. Relying on anecdotal methods can lead to flawed assessments and misguide strategic decisions. To address this challenge, our team developed and tested the Palo Alto Networks Unit 42 Attribution Framework, a data-driven methodology that provides a structured, repeatable approach. This framework allows security teams to build defensible intelligence assessments that stand up to scrutiny and inform critical decisions. The framework is built on three distinct levels of attribution that ensure a methodical progression from raw data to a high-confidence assessment: - Activity Clusters: Foundational level where observed activities are grouped by shared indicators or TTPs. - Temporary Threat Groups: An activity cluster can be elevated to this level once a single actor is confidently involved. - Named Threat Actors: Highest level of attribution, assigned only when there is sufficient visibility from multiple reliable sources. Having used this internally for over a year, we have seen its effectiveness in providing clear, actionable context. Thank you Andy Piazza for your efforts driving and sharing our work here. https://lnkd.in/gRGMyhjy

Crogl, Inc. just announced US Patent 12277177B1 for analyzing non-normalized security data. Here's the problem we solved: Data normalization creates three critical bottlenecks that most SOCs face daily: 1. Massive implementation lift – costly data cleaning, standardization projects, and vendor lock-in 2. Cognitive overload – analysts trying to memorize hundreds of schemas and query languages across constantly evolving environments 3. Lost intelligence – normalization drops vendor-specific fields and context that matter during investigations Our patented approach enables our Knowledge Engine to traverse and interrogate security data across various sources in place, without requiring normalization. Think of it like a semantic layer that maps similar concepts together – when you search for an IP address, it finds everything that looks like an IP address, regardless of what it's called in each system. The impact: Customers deploy Crogl without data movement, normalization projects, or lengthy onboarding cycles. As Filip Stojkovski from SecOps Unpacked put it: "We need systems that work with data as it exists, not as we wish it existed." That's exactly what we built. And now it's patented. Read the full announcement: https://lnkd.in/gR6djxjS #Crogl #Cybersecurity #SecOps #Patent #Innovation

97% of organizations that reported an AI breach had no AI access controls in place. Not weak controls. No controls. AI agents don’t create new security problems. They amplify the ones you already have, at machine speed, massively in parallel and with no inhibition. 29 million secrets leaked on GitHub last year, up 34%, largely driven by AI agent credential sprawl. At Cerbos we give teams full control over what every AI agent can access, with the ability to revoke it in seconds through policy. Over a billion authorization checks a month, used by companies like Utility Warehouse, Culture Amp and Envoy, across thousands of services. See how to secure your AI agents → https://lnkd.in/dQnTt5fG

Most security programs have spent the last decade getting authentication right. MFA, SSO, conditional access, the front door is solid. What’s quietly fallen behind is authorization, what an identity can actually do once it’s inside. At most companies that logic is scattered across application code, owned by whoever last touched it, with no single view of who can reach what. So when a regulator or an audit committee asks where you stand, the honest answer is usually “I’ll get back to you.” That gap, between what your documentation says and what actually runs in production, is where a lot of breaches now start. And in this layer, when something goes wrong, it’s the security leader who answers for it. So I built a benchmark to fix that: ✅ It places your program on a four-stage scale, from ad-hoc to fully governed ✅ At each stage it shows how exposed you are to each major regulator (NIS2, DORA, SEC, the EU AI Act), so you can see what a gap would actually cost you ✅ There’s also a 15-question self-assessment to find your starting point, and a 90-day plan so you can close the gaps before one becomes the breach you get named in It comes out of the work we do at Cerbos with security teams in regulated industries, major identity and security events, and the OpenID AuthZEN standard I help shape. You can get the free ebook here 📕 https://lnkd.in/g9MDbTxe

E se a chave para desbloquear o próximo nível da sua empresa de segurança já existisse, mas você ainda não a viu? Depois de anos conversando com centenas de empresas do setor, percebi um padrão: nem sempre o problema é falta de tecnologia. É falta de direcionamento estratégico. Por isso criamos algo que vai mudar completamente seu modo de operar: um e-book com 50 prompts prontos para transformar sua operação. Não é só mais um material. É um kit de sobrevivência para quem quer sair da mesmice. O que você vai encontrar: 🎯 Prompts para prospecção inteligente 🤖 Estratégias de IA para otimizar processos 📈 Comunicação que atrai e engaja clientes 👥 Gestão de equipe com produtividade máxima É como ter um consultor estratégico 24h por dia, sem pagar salário de executivo. Curiosidade: cada prompt foi construído a partir de casos reais que vi no mercado de segurança. Situações que travaram ou impulsionaram negócios. Quer dar o próximo passo? Acesse o link https://lnkd.in/d2kd7UNJ e baixe o e-book que a Camerite preparou.

Security debt grows fast when security testing happens too late in the development process. Many teams still rely on manual penetration testing at the end of a sprint. This creates a hard choice between shipping fast and reducing risk. A real shift-left approach means adding DAST directly into the CI/CD pipeline, so developers get security feedback early - while they are still building. Instead of fixing vulnerabilities later, teams can prevent them before they reach production. Bright helps teams automate this process without slowing down development. Learn more here: https://lnkd.in/dEnTw-gX #AppSec #DevSecOps #SoftwareSecurity #ApplicationSecurity #ShiftLeft

Regulators are getting smarter, and #compliance evidence needs to get smarter with them. I’m looking forward to joining Scrut Automation webinar on how #security and compliance teams can move from audit-time scrambling to continuous and defensible proof. In #appsec, that shift is especially important: evidence cannot just show that a #scan happened, but that risks were validated, prioritized, remediated, and verified. That is the experience we at Bright gained the hard way, evolving our continuous security #testing and #AI-assisted #remediation workflows through Bright STAR, and that is precisely the kind of experience we aim to convey through well-assembled online gatherings like this one. Register and join us: https://lnkd.in/dcQKxVaT

Cybersecurity's biggest problem isn't underinvestment. It's investing in the wrong things first. Most organisations buy SOC, XDR, and detection capabilities before they understand what they're actually exposing to attackers. After years in this industry, I've seen the same pattern repeatedly: organisations spend heavily on alarms before they know which doors and windows are open. That's not a security strategy. It's often an expensive way to generate noise. In our latest research, based on 750,000 external security scans across 400 organisations, every organisation had at least one critical external exposure they were unaware of. Detection tells you when an attacker finds the problem. Exposure management helps you fix it before they find it. That's why I wrote a short guide for CFOs, board members, and executive leaders who are making cybersecurity investment decisions and want a clearer framework for prioritising security spend. If it helps, feel free to download it and share it with your board - https://shorturl.at/nhJbK

𝗪𝗮𝘀 𝗽𝗮𝘀𝘀𝗶𝗲𝗿𝘁, 𝘄𝗲𝗻𝗻 𝗔𝗻𝗴𝗿𝗲𝗶𝗳𝗲𝗿 𝗽𝗹ö𝘁𝘇𝗹𝗶𝗰𝗵 𝟭𝟬𝟬× 𝘀𝗰𝗵𝗻𝗲𝗹𝗹𝗲𝗿 𝘄𝗲𝗿𝗱𝗲𝗻? Genau diese Frage hat Sandra Känzig und mich in den letzten Monaten intensiv beschäftigt. Morgen stehen wir deshalb wieder gemeinsam auf der "Bühne". 🎤 Etwas vom Schönsten an meiner Arbeit ist die Zusammenarbeit mit Menschen, die den Mut haben, den Status quo zu hinterfragen. Menschen, die überzeugt sind, dass es einen besseren Weg gibt – und bereit sind, ihn konsequent zu gehen. Genau so eine Partnerschaft verbindet uns seit 2021 mit der Helvetia Baloise Gruppe. Was damals für viele noch ungewohnt klang, ist heute Realität. Ü𝗯𝗲𝗿 𝟱𝟬𝟬 𝗲𝘁𝗵𝗶𝘀𝗰𝗵𝗲 𝗛𝗮𝗰𝗸𝗲𝗿 𝘁𝗲𝘀𝘁𝗲𝗻 𝗱𝗶𝗲 𝗦𝘆𝘀𝘁𝗲𝗺𝗲 𝗿𝘂𝗻𝗱 𝘂𝗺 𝗱𝗶𝗲 𝗨𝗵𝗿, 𝗼𝗿𝗰𝗵𝗲𝘀𝘁𝗿𝗶𝗲𝗿𝘁 𝗱𝘂𝗿𝗰𝗵 𝗲𝗶𝗻 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝘁𝗲𝘀 𝗣𝗹𝘂𝗴-𝗮𝗻𝗱-𝗣𝗹𝗮𝘆 𝗦𝘆𝘀𝘁𝗲𝗺. Das Ergebnis? ➡️ Ein 𝗘𝗰𝗵𝘁𝘇𝗲𝗶𝘁-𝗟𝗮𝗴𝗲𝗯𝗶𝗹𝗱 über die Testabdeckung und Verletzlichkeiten ➡️ 106 validierte Sicherheitslücken mit 𝗸𝗼𝗻𝗸𝗿𝗲𝘁𝗲𝗻 𝗛𝗮𝗻𝗱𝗹𝘂𝗻𝗴𝘀𝗲𝗺𝗽𝗳𝗲𝗵𝗹𝘂𝗻𝗴𝗲𝗻. ➡️ Darunter eine kritische Remote Code Execution im produktiven E-Banking – entdeckt, bevor Angreifer sie ausnutzen konnten. Doch seit dem Durchbruch der künstlichen Intelligenz hat sich die eigentliche Frage verändert. 𝗪𝗲𝗻𝗻 𝗔𝗻𝗴𝗿𝗲𝗶𝗳𝗲𝗿 𝗱𝗮𝗻𝗸 𝗞𝗜 𝟭𝟬𝟬-𝗺𝗮𝗹 𝘀𝗰𝗵𝗻𝗲𝗹𝗹𝗲𝗿 𝘄𝗲𝗿𝗱𝗲𝗻 – 𝘄𝗮𝗿𝘂𝗺 𝘁𝗲𝘀𝘁𝗲𝗻 𝘄𝗶𝗿 𝘂𝗻𝘀𝗲𝗿𝗲 𝗦𝗶𝗰𝗵𝗲𝗿𝗵𝗲𝗶𝘁 𝗻𝗼𝗰𝗵 𝗺𝗶𝘁 𝗠𝗲𝘁𝗵𝗼𝗱𝗲𝗻 𝗮𝘂𝘀 𝗲𝗶𝗻𝗲𝗺 𝗮𝗻𝗱𝗲𝗿𝗲𝗻 𝗭𝗲𝗶𝘁𝗮𝗹𝘁𝗲𝗿? Über genau diese Frage durften wir kürzlich am 𝗧𝗮𝗴 𝗱𝗲𝗿 𝗩𝗲𝗿𝘀𝗶𝗰𝗵𝗲𝗿𝗲𝗿 sprechen. Die Resonanz war so gross, dass wir das Thema morgen in einem einmaligen Live-Webinar nochmals vertiefen. Keine Marketingfolien. Keine Buzzwords. Sondern ehrliche Praxiserfahrungen, konkrete Erkenntnisse und eine offene Diskussion darüber, wie sich Security Testing im Zeitalter der KI verändern muss. 📅 29. Juli | 11:00 Uhr 🎟️ Kostenlose Anmeldung: https://lnkd.in/ePvb3XJf 𝗠𝗶𝗰𝗵 𝗶𝗻𝘁𝗲𝗿𝗲𝘀𝘀𝗶𝗲𝗿𝘁 𝗲𝘂𝗿𝗲 𝗘𝗶𝗻𝘀𝗰𝗵ä𝘁𝘇𝘂𝗻𝗴: 👉 Wird der klassische jährliche Penetrationstest in fünf Jahren noch der Standard sein – oder wird kontinuierliches, KI-gestütztes Security Testing ihn ablösen?

Healthcare has had a compliance requirement for thirty years that AI agents violate by default. It's called the minimum necessary standard, and every Copilot deployment touching patient records is testing it right now. The minimum necessary standard is one of HIPAA's foundational Privacy Rule requirements. It demands that access to protected health information be limited to exactly what the specific task requires. Not what the system can reach. Not what permissions allow. What the task requires. Every covered entity and business associate in the United States is bound by it. The problem is that standard was written for a world where a human being made every access decision. The physician reviewing a record. The billing specialist pulling a chart. A person who understood the patient relationship, the purpose of the request, and the regulatory obligation attached to it. That judgment was never codified in a label or a permission entry. It lived in the person doing the work. When a health system deploys Copilot across administrative workflows or an AI agent across revenue cycle operations, that person steps back. The agent has the access. It does not have the judgment. And the most dangerous failure mode isn't an unauthorized party reaching patient records. It's an authorized agent surfacing psychiatric history in a billing workflow, or pulling a complete episode record when a single encounter note was the only appropriate scope. No unauthorized access occurs. The minimum necessary standard is violated anyway. In January 2025, HHS published a proposed major update to the HIPAA Security Rule — the first of its kind in roughly two decades — signaling that AI systems operating across clinical and administrative workflows are squarely inside the compliance framework, not a future consideration. The full piece is in the comments. Curious whether compliance teams at the health systems you work with have confronted this distinction yet. #AISecurity #DataSecurity #HIPAA #HealthcareAI #AIGovernance #CISO #DataProtection #Cybersecurity #AIRisk

In biotech and pharma, the worst AI incident of the year will probably never be classified as a breach. A data breach has a clear anatomy: unauthorized access, a disclosure notification, a remediation timeline. Trade secret loss in a research organization looks nothing like that. It looks like a scientist using Copilot or a custom AI agent to speed up a literature review, pulling from internal compound databases alongside public sources, with no way for the agent to know which structures are pre-patent, which are bound by a confidential disclosure agreement, or which sit inside an exclusivity deal. The agent retrieves what it can reach and assembles what the prompt asks for. Nothing about that looks like an incident. It may already be one. Financial services operationalized judgment through regulatory frameworks. Healthcare built it into HIPAA's minimum necessary standard. Biotech and pharma never had that luxury. The judgment that kept pre-patent compounds separate from public research, and kept one partner's term sheet from bleeding into another program's analysis, lived in the experience of research directors who knew the relationships behind the data. AI agents inherit the file permissions. They don't inherit the context that made those permissions meaningful. Access control was never built to answer the question that matters here: not who can open a file, but whether the obligations attached to it survive being retrieved and reasoned over by a system with no concept of whose IP it's holding. The full piece is in the comments. For anyone in life sciences security, where is that judgment actually living in your organization today? #AISecurity #DataSecurity #AIGovernance #Biotech #PharmaSecurity #IPProtection #TradeSecrets #ClaudeAI

A good door joke hates to see me coming...Poor Pasta wouldn't have had that problem if he had a mobile credential!! Over 75% of properties still rely on metal keys, and over half of property owners are paying $85 or more PER UNIT to rekey! A penne for my thoughts 😏? Brivo's Multifamily Myths playbook is a must have for multifamily owners & operators: https://lnkd.in/eBw2btsh

Somewhere in your tenant, someone just completed MFA with a code sent by text. From 1 September, Entra ID starts nudging that person to register a passkey, and they can snooze it as often as they like. On 1 February 2027 the same prompt stops being optional. Every tenant, no opt-out. It is the right change, and overdue. SMS is the weakest method most tenants still allow. But two things catch people out. Microsoft retires SMS and voice for you, and leaves every other phishable method exactly where it is. Self-service password reset is in scope too. I wrote about this when the announcement landed in July. The question I kept coming back to was not which method to pick, but who is actually affected, and most tenants cannot answer that quickly. On 8 September I am doing 30 minutes on what changes, where you are still exposed afterwards, and how to see who only has SMS or voice, and who has no MFA at all. For Entra administrators, and for whoever has to answer in January whether the tenant is ready. Sign up and I will send you the recording either way: https://lnkd.in/e3X6Ekvb You cannot migrate users you cannot see.

As opposition to AI data centers intensifies, coordinated narrative attacks are adding another layer of pressure for technology leaders building AI infrastructure. Our RAV3N Research Team analyzed five narratives surrounding a leading chipmaker's data center push, including export-control concerns, local opposition, federal policy, and efforts to portray grassroots protests as foreign-backed interference. As pressure builds, data center announcements can quickly be pulled into political or geopolitical debates, or become the target of a coordinated narrative attack. That can intensify opposition, attract greater policy scrutiny, and complicate future development plans. Read the full analysis here: https://bit.ly/4qLyEyQ