LinkedIn thought leader ad examples

Calling all security practitioners: it’s time to build! #SWARMGlobal is a free-entry virtual event where you’ll build open-source AI agents, skills, and MCP servers for real workflows like alert triage, remediation orchestration, and executive reporting. Sponsored by Tenable with support from Anthropic, it runs November 2-6 with a hands-on tutorial, office hours, and a live pitch day for the top teams. Registration closes November 1st. Sign up today! https://lnkd.in/eKrQWKeq

🚨 1,407 CVEs fixed by Microsoft yesterday: a new Patch Tuesday record, for the second month in a row. 📈 198 in June, 569 in July, 398 in August, 964 in September, 1,407 in October (Tenable Research counts). That is 7.1x in four months, with four records in five releases. Before June, the record stood at 167 CVEs. Three takeaways 👇 1️⃣ Volume is no longer a proxy for risk: critical CVEs now account for just 4.9% of the total, versus 16.2% in June. Triaging on CVSS alone is no longer enough. 2️⃣ Elevation of privilege dominates: 47.9% of Octobers CVEs, up from 31.8% in June. 3️⃣ Exploitation remains concentrated: six exploited zero-days in five months. In October, CVE-2026-96951 (Mark of the Web bypass in Windows Shell) was exploited in the wild, the third exploited Windows Shell flaw of 2026. CVE-2026-108398 (.NET, WDAC bypass) was publicly disclosed before a patch was available. With agentic AI now driving vulnerability discovery, these volumes are not coming down. 🎯 The question is no longer how many CVEs?, but which ones are exploitable in my environment, on which exposed assets?. That is the shift from vulnerability management to exposure management. 🔗 Full Tenable Research analysis: https://lnkd.in/etS5dNwS #ExposureManagement #VulnerabilityManagement #CyberSecurity #ZeroDay #Tenable

Every piece of software is hackable. Every agent needs a security boundary. Every assumption is an attack surface. The Hugging Face incident just triggered a new reset in agentic security. A well-defined agent harness is all anyone needs to perform a denting software hijack. Hugging Face was even using an open-source Chinese LLM to defend its systems. The attack surface has widened so drastically that InfoSec teams still aren't sure what exactly needs to be protected or how far that protection needs to go. From social engineering to prompt injection, from abusing tools to cracking and choking systems, the attack surface is expanding across every layer. And with every release of LLMs (open or closed), they will only get better, cheaper, and more clever. The cost of defending against these swarms of attacks will keep going up, unless you move proactively on this front. For now, what every enterprise can do is at least measure & minimise the surface area: • Pressure-wash your codebase. • Keep the harness simple. • Point agents at specific attack surfaces. • Turn every finding into a new hunting pattern. • Treat every new model as another security researcher. • Make vulnerability hunting continuous. Just like what Teleport did. They let 13 Engineers spend three months finding vulnerabilities with LLMs. Worth a read: https://fandf.co/3T7FvWL Thanks to Teleport for collaborating with me on this post & spreading agentic security awareness.

We spent the last decade drilling specific themes into every engineering org. Eliminate standing access, kill the static credentials, the shared accounts, the long-lived secrets, and give humans short-lived, just-in-time access scoped to what they actually need. Then we started handing AI agents the keys, and quietly threw most of that out the window. Agents are getting provisioned with exactly what we've spent years eliminating for humans. Long-lived API keys, broad standing privileges, credentials baked into a config somewhere, and unlike a human, an agent operates autonomously, at machine speed, across many systems at once. A static credential handed to an agent isn't a shortcut, it’s a standing liability with a much bigger blast radius. The good news is this isn't a new problem, it's the same identity and access problem we already know how to solve. Short-lived credentials over static secrets, least privilege enforced at the infrastructure layer, and real visibility into what every agent accessed, when, and why. The Zero Trust principles we built for humans have to extend to agents, or the model breaks the moment agents touch production. This is the exact problem space Resilient Cyber’s partner Teleport is focused on. Extending identity-based access and strong controls across both human and machine identities as AI moves deeper into infrastructure. Read more on their write-up on Identity Security for AI: https://fandf.co/4xHInZh #Sponsored

In light of recent news - Adobe clone, Artcraft stirring things up, and Anthropic building their own internal replacement of Git - naturally, everyone's minds are swirling about what else should be vibe-coded as a bespoke software solution for my business? I took a cut at exploring that exact question in this article, "Can an LLM Replace Software Composition Analysis?" Take a look - tell me what you think. Crazy times we live in. It's important we keep our wits about us. #AgenticSCA #SoftwareSupplyChain #SBOM #VibeCoding https://lnkd.in/gNFSwDEB

How do you run Sovereign AI on regulated data when the data, the prompts and the model weights are all exposed the moment the workload runs? That's what we're showcasing at NVIDIA GTC Berlin. Fortanix Confidential AI runs on NVIDIA Hopper, Blackwell and Vera Rubin with NVIDIA Confidential Computing: attestation across CPU and GPU, and keys released only from a FIPS 140-2 Level 3 HSM. Live demos at Booth 7017, 21–22 October, tailored to your stack. Let's meet up: https://lnkd.in/e3KZgw3N #ConfidentialComputing #ConfidentialAI #NVIDIAGTC #SecureAI #EnterpriseAI #AIFactory

Panel 1: “What happens to our data and model weights during inference, training?” That’s the question I’m opening with when I moderate the first panel at the Fortanix Confidential AI Summit at NVIDIA GTC Berlin next Thursday. On stage with me: Erik Bohnhorst, NVIDIA Kabir Gill, ElevenLabs Víctor Mateu, Technology Innovation Institute Allen Roush, Alpha Compute Most enterprise teams have encryption at rest and in transit covered. The gap is during inference, when prompts, model weights, and sensitive inputs sit exposed to whatever shares the machine. On-prem doesn’t close it on its own. Register for the Confidential AI Summit: https://lnkd.in/gsyVWtam Stay tuned for second panel! #confidentialcomputing #secureai #aisafety #confidentialai #genai #nvidia #gtcberlin2026

Speaking at the PwC CISO 500 was, undoubtedly, the highlight of my last stop in Riyadh. Looking at the participants, I could not help feeling a little jealous. Spending a full year with senior cyber officers, learning the hard skills and the soft skills. Ninety minutes of live interaction, full of unexpected questions such as, “should we trust cloud native based software?”

Have had several conversations with customers over the past few weeks about vendors deepfaking their executives without permission. I was surprised to hear this. In the business we're in, trust is critical, and we think it's important to get permission before generating a deepfake. See more on our stance at Doppel here: https://lnkd.in/guD-hwBA

Software engineers no longer code manually. Why should security engineers have to? We have been early adopters of AI coding experiences since day 1 at Doppel, and we’re bringing those user experiences to the security stack. In particular, we most recently announced our entry into email security. Many of the incumbent “AI-native” email solutions aren’t quite that – still opaque black boxes or convoluted white boxes that are difficult to reason through, debug, and update. True AI-native defense replaces this experience with reasoning-based agents. It turns the day-to-day workflow from a debugging nightmare into a peer-to-peer conversation with an autonomous agent. And it enables autonomous patching without human-in-the-loop. Alvin Lin and I just published a new piece breaking down the core vectors of this architecture. If you're curious about how we're approaching the future of inbox defense, give it a read: https://lnkd.in/grRSYdbU

Protecting critical infrastructure means protecting the services that keep our societies functioning – and more importantly the trust people place in them. Following the event co-hosted with Access Partnership, I have been reflecting on the value of bringing together critical infrastructure operators, cybersecurity experts and public institutions. Across energy, telecommunications, manufacturers, international humanitarian organisations, public administration, and defence, the challenges are interconnected and need a common response. Three reflections stand out for me. First, the evolving regulatory framework is reshaping how organisations assess risk and select technology. Translating requirements into practical security measures takes work and resources, particularly when organisations operate across sectors and borders. Long-term decisions need to support compliance today while allowing organisations to adapt as expectations, policies, and geopolitical relations evolve. Second, choosing a trusted technology partner is a strategic decision. Technical capability matters, alongside responsible transparency, accountability, continued investment in innovation and a demonstrable commitment to the organisations and communities being protected. Trust is built through consistent actions over time. Third, public-private dialogue is crucial to the resilience of organisations and the society. Critical infrastructure operators understand the realities of delivering essential services while technology providers bring insights into threats and defences. Public institutions bring policy direction and a wider view of society’s needs. Bringing these perspectives together is necessary to turn shared concerns into practical partnerships. My strongest takeaway is that cybersecurity must be part of how we design, operate and modernise critical infrastructure. The partnerships we build today will shape our ability to withstand disruption tomorrow. Thank you to Access Partnership and everyone who contributed with their experience and perspectives. Let’s keep the dialogue going - and translate it into action together. Dr. Tommaso De Zan, Trevor H. Rudolph, Alain Sanchez #Cybersecurity #ProtectCriticalInfrastructure #Resilience #PublicPrivatePartnership

Imagine if the entire internet was scanned and we knew what was exposed across all 65,535 ports. Well, it was and here are the results: Thirty years ago I remember dialing into the internet. I connected, surfed the web, checked email and then disconnected so my dad could have the phone line back to make calls. Today everything is connected, all the time. As someone who went on to work as a penetration tester for years, it was always amazing to me that we're only milliseconds away from nearly any connected device in the world, digitally. However, what started as a fascination has become scary. The shape of the internet as a whole, has become a nightmare. There's a report that just came out called the "2026 State of the Internet Report" that includes data from the entire internet, literally. The report was written by Censys, who scans 218 million hosts, 17 billion certificates, and 2.4 billion web properties. They scan the entire IPv4 address space across 65,535 ports and leverage DNS to discover IPv6 systems and detect more than 200 protocols. This year the report focuses on 5 key areas of internet exposure: 1. The Shape of the Internet: the biggest takeaway here is that services aren't living on default ports. 34% of SSH, 68% of HTTP(S) and 96% of SOCKS proxies are running on non-standard ports. The issue here is that security practitioners and detection methods typically look in default places. This makes it extremely hard for an organization to understand what's exposed. 2. Vulnerability Response: If software is old, it probably isn't going to be updated. Four case studies done over two years showed that older software wasn't really being updated. Middle aged software saw the largest share of updates. So those older systems still hanging around are extremely dangerous. 3. Industrial Control Systems and Critical Infrastructure: As of 2026, North America leads in ICS exposures. This represents 38% of the global ICS landscape. Over 80% of ICS systems run non-ICS services like HTTP, SSH, or FTP, increasing the attack surface. 4. Threat Infrastructure and Adversary Tools: Across the globe, China and the U.S. host most of the world's malicious software and services. China hosts 36.6% of malicious host-level infrastructure (C2s). The U.S holds 45.5% of web based threats like phishing and other deceptive pages. 5. Exposed AI Infrastructure: 267,915 unique hosts were observed exposing AI/LLM related tools. This rose 63% in just nine months. A recognizable AI infrastructure stack is emerging on the public internet. Exposed systems across 20+ categories were seen forming the layers needed to operate AI workflows. I've only touched lightly on these 5 categories, but this is easily the best report I've read this year. It's important that we understand exposure and the risks that come with it. Check out the report at: https://tr.ee/45hqnV Thank you Censys for letting me partner with you so I could share this information.

When we started Cyberhaven, data lineage in security was an idea most people hadn’t heard of. Today it’s everywhere, and every DLP vendor seems to have “lineage” on their slide. Honestly, that makes us proud. We pioneered data lineage for data security, and it’s a bit like watching your kid grow up and seeing the whole neighborhood try to copy their style. But not all lineage is the same. Building lineage that holds up at enterprise scale is hard. It means: - A purpose-built graph engine handling roughly a trillion nodes, fast enough to block in real time - Endpoint sensors that cover every way humans and AI agents move data, while using a median of 0.2% CPU - AI that understands business context, so DLP stops being a game of thousands of exceptions and endless false positives Volodymyr Kuznetsov, Radu Banabic, and I wrote up what we’ve learned from years of building this, including what it really takes to tell lineage that works apart from lineage that only looks good in a demo. Because not all lineage is the same - https://lnkd.in/gy5hPPEK #DataSecurity #DLP #DataLineage #AI #Cybersecurity

Everyones worried about frontier models finding zero-days right now, but most teams were already way behind on plain old CVEs before any of this started. Ive run vuln management on some big codebases and the backlog is very real. The average enterprise is months behind on patches that have had fixes, advisories, and scanner coverage for years. This weeks Vulnerable U sponsor, Chainguard, is doing its part by sharing the threat intel theyve collected through Athena with the rest of the ecosystem. They’ve started publicly disclosing the zero-days theyve collected, validated, and remediated, and they put the patch files up on GitHub for anyone to grab. If youre a Chainguard Libraries customer you also get remediated artifacts you can swap straight into your apps. See how Chainguard is protecting everyone from zero days: https://lnkd.in/gY-WeB7z

Microsoft's October Patch Tuesday shipped 1,411 vulnerabilities: 70 critical, 3 zero-days, and one already exploited in the wild (breakdown via BleepingComputer). Two years ago, a normal month was about 100. This month it was 1,411. Microsoft says AI-assisted discovery will keep pushing that number up. Patch faster? Not really... So look at the mix, not the total: → 317 remote code execution flaws. Each one needs a reachable path. → 677 privilege escalation flaws. Each one needs a foothold and permissions worth escalating into. Both preconditions are access. Remove what’s configured but never exercised, and a large share of that exposure can’t be reached, including flaws that don’t have a CVE yet. That makes infrastructure controls your first line of defense against zero-days. Act exists so teams can stop chasing the queue and start acting - safely and sustainably.

Big one for us: Act is now part of the Microsoft for Startups Pegasus Program. Finding risk was never the bottleneck. Acting on it is. That’s why we built Act: to take action on access in the cloud, so the paths attackers rely on stop existing. Pegasus gives us access to Azure’s AI models and the people running some of the largest cloud environments out there. That’s where cloud problems get real, and where we want to be building. Thank you Meital Shamia, Kevin Magee, Tom Pauly, and the whole Microsoft for Startups team.

I’m super proud of the Glow team for being included in the #Disruptors60 list curated by Greenfield Partners at TechCrunch Disrupt for advancing AI. With all the AI noise and dozens of new companies, at Glow we are heads down focused on solving real problems for our customers - protecting where people and agents do work… end the end. Businesses needs to innovate. Allowing them the ability to do that safely is core to the modern security program. Congrats to the entire Glow team for your every day dedication and to our incredible customers and partners for their trust in us. 🧡 Roi Tiger Ophir Arie Omer Singer Arnon Joseph Patti Degnan Eileen Wade Jake Martens Martin Bally David Sledge Kody Paine Jay Maples Jenny Fong James Serassio Julie Compton Emily Hines

For a long time at GitGuardian, we secured secrets where we assumed they lived: in the code. Attackers found a new target recently: developer laptops (and obviously vibe coder laptops) Every major supply-chain attack pushed them toward the place credentials actually pile up the developer laptop. Shell histories, .env files, CLI caches, and now AI agent configs from Cursor, Copilot and Claude Code. Our early-access data: ~40% of them are written there by the AI agents themselves, in terminal sessions, output logs and caches no repo scanner ever checks. So we built for the assumption every security team should make: These devices will be compromised. The only question is whether you'll know what was on it. Today we're shipping Developer Endpoint Protection, built into ggshield: → Limit the blast radius → Detect live attacks with honeytokens → Remediate at the source Find and remediate critical exposed credentials before attackers can steal them

Insider risk should be managed left of boom. A pretty extreme case of malicious insider threat. Insider threats come in every color, from malicious espionage to simple negligence. But what interests me is what happened before they found the device. I'm sure there were earlier behavioral signals that, when connected, could have raised suspicion. Not when you discover the recording device, but when the risk starts developing.

📞 Este sábado 17 de octubre cambia la forma de hacer llamadas comerciales en España. Como recuerda el ministro Óscar López en este vídeo de Europa Press, las llamadas comerciales destinadas a captar nuevos clientes deberán utilizar el prefijo 400. Una medida que busca proteger al consumidor, pero que plantea un nuevo reto para las empresas: ¿cómo conseguir que los clientes sigan respondiendo al teléfono? Aquí es donde Hiya y nuestra solución Branded Calls cobran todavía más sentido. Permitimos que las empresas identifiquen sus llamadas salientes mostrando su nombre generando confianza desde el primer segundo. Porque una cosa es identificar que una llamada es comercial y otra muy distinta es saber quién te está llamando. Si quieres conocer cómo Hiya puede ayudar a tu empresa a proteger sus tasas de respuesta ante este nuevo escenario, aquí tienes toda la información: https://lnkd.in/eE2A-WdB #BrandedCalls #Contactabilidad #CustomerExperience

A GreyNoise product demonstration led to the initiation of a intrusion investigation and some follow-up research into a malicious cyber actor conducting proxyjacking operations against network edge devices turning them into commercially available residential proxies. https://lnkd.in/eRftmJYY

Nearly half (48%) of breaches now come through a third party and the broader supply chain ecosystem. Three years ago, it was 9%. I spent years sending vendor security questionnaires. What I was really buying wasn't risk reduction, it was a defensible file. If something went wrong, I could point to the PDF and say: I asked. That's not security risk management. That's paperwork with a due date. Here's the problem: A questionnaire is a snapshot. We use it like a live feed. A vendor tells you in March they have MFA everywhere. In June they acquire a company, inherit a flat network, and nobody sends you an updated form. Your answers are stale before you finish the risk assessment. And that's just one vendor. Across your supply chain, the surface area is exponential. That's not managing risk. It is managing a third-party spreadsheet or expensive application. I'm not saying we stop asking questions. I'm saying the answers expire and the assessments based on them. I've stopped pretending an annual review tells me anything about my actual exposure across the ecosystem today. To my fellow CISOs reading this: Has anyone actually killed the questionnaire? Or are we all still filing them—knowing they don't mean what we're pretending they mean? Tell me in the comments. Or send me a DM if you'd rather not say it out loud. #ecosystem #CounterThreatOperatingSystem #CTOS #iCOUNTER

MONDAY MOAN Resilience is hard to understand in cyber right now...We at Gambit Security are working hard to define it but there is so many different version out there right now. Let's start on things we agree on... 🔴 The current approach is BROKEN! Tabletop tests are like dungeons & dragons for executives & as a CISO I can tell you I will never run a tabletop I'm going to fail. Then we move on to simulations...We spend weeks prepping for them, assign people to the time period required, ensure they have the necessary skills & build a perfect environment...One I am not going to fail! The way we test resilience right now is based on DR & IR...𝗜𝗧 𝗗𝗢𝗘𝗦 𝗡𝗢𝗧 𝗪𝗢𝗥𝗞! 🔴 SOC 2, ISO 27001, FedRAMP, HIPAA, PCI DSS and DORA all touch resilience through recovery, continuity, availability and testing. But in practice, we still audit plans, backups, RTOs and annual exercises. In an AI age where attacks adapt and infrastructure changes constantly, that is weak evidence. If you cannot prove the business can still operate today, you are not auditing resilience. You are auditing paperwork...𝗜𝗧 𝗗𝗢𝗘𝗦 𝗡𝗢𝗧 𝗪𝗢𝗥𝗞! Resilience is the ability for your MVB to survive in any circumstances. You need to be able to 𝗽𝗿𝗼𝘃𝗲 𝘁𝗵𝗮𝘁 in your current environment 𝗮𝗹𝗹 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲 and in 𝗿𝗲𝗮𝗹 𝗱𝗮𝘁𝗮 even when 𝘆𝗼𝘂𝗿 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀 𝗮𝗿𝗲 𝗰𝗼𝗻𝘀𝘁𝗮𝗻𝘁𝗹𝘆 𝗰𝗵𝗮𝗻𝗴𝗶𝗻𝗴. Find out how resilient you are...https://lnkd.in/etKYtXk3 𝘠𝘦𝘴 𝘐 𝘥𝘰 𝘭𝘰𝘷𝘦 𝘚𝘵𝘳𝘢𝘯𝘨𝘦𝘳 𝘛𝘩𝘪𝘯𝘨𝘴 𝘢𝘯𝘥 𝘵𝘩𝘦 𝘴𝘩𝘰𝘸 𝘪𝘯 𝘵𝘩𝘦 𝘞𝘦𝘴𝘵 𝘌𝘯𝘥 𝘪𝘴 𝘈𝘔𝘈𝘡𝘐𝘕𝘎!

A full commit SHA pin can still run an attacker's code. Yes, you read it right. Forks share their parent's object store, so a fork-only commit is reachable through the original project's name. SHA pinning checks validity, not provenance. Don't get me wrong: pinning to a SHA commit is still a good practice, but for today's threat landscape that is not enough to secure your CI/CD. The good news is that Chainguard Actions is now GA: actions rebuilt from verified source, hardened, and continuously re-evaluated. I talked a bit about this in this short video! I will also be running 2 webinars about the topic in the upcoming weeks. Two opportunities to learn about securing your GitHub Actions beyond SHA pinning! I'll share the links to both webinars in the comments. #GitHubActions #SupplyChainSecurity #DevSecOps