LinkedIn thought leader ad examples

Fix it or shut it down. That’s been the reality for security teams worldwide over the last four days. PHP2Shell is shaping up to be one of the most significant vulnerability events of 2026. Two flaws in PHP’s core memory allocator (CVE-2026-109618, CVE-2026-109619) enable unauthenticated remote code execution. Each is unreliable on its own. Chained, they’re reliable enough against default configurations that any PHP endpoint accepting file uploads becomes a target. At Tenable’s EXPOSURE event in May, I shared Mandiant’s time-to-exploit data: 63 days in 2018, 5 days in 2023, and 𝑚𝑖𝑛𝑢𝑠-7 days this year. The line has crossed zero. PHP2Shell is what that looks like in practice: ✴️ Amazon’s MadPot honeypots recorded active exploitation on Oct 17, four days before public disclosure. ✴️ The embargo leaked 18 hours early via a Hacker News post. ✴️ Cloudflare saw “thousands” of exploitation attempts within hours of the advisory, rising to “millions” after publication. ✴️ Nine government agencies across seven countries issued advisories or directives. Six ordered preemptive shutdowns of PHP-dependent services. The exposure is immense. More than 22M PHP server headers are visible online, and patch adoption is 2.8%. About 59% of exposed hosts run end-of-life versions with no official patch. For most of this surface, the patch cycle isn’t slow. 𝐈𝐭 𝐝𝐨𝐞𝐬𝐧’𝐭 𝐞𝐱𝐢𝐬𝐭. This is structurally different from past web vulnerabilities. The flaws were found with the help of frontier AI, and AI is compressing exploit development from weeks to days. Ironically, major cybercriminal forums (more here: https://lnkd.in/d_yUAxPs) took themselves offline within hours, because their own PHP infrastructure was at risk. Many organizations didn’t even know they ran PHP. Let alone how to patch or mitigate it. 𝐘𝐨𝐮 𝐜𝐚𝐧’𝐭 𝐬𝐞𝐜𝐮𝐫𝐞 𝐰𝐡𝐚𝐭 𝐲𝐨𝐮 𝐜𝐚𝐧’𝐭 𝐬𝐞𝐞. In 2026 that principle has a second half: 𝐲𝐨𝐮 𝐜𝐚𝐧’𝐭 𝐝𝐞𝐟𝐞𝐧𝐝 𝐚𝐭 𝐡𝐮𝐦𝐚𝐧 𝐬𝐩𝐞𝐞𝐝 𝐚𝐥𝐨𝐧𝐞. To borrow an analogy from forest firefighting, the six government agencies who shut down their services cleared the fuel the hard way. The better way is to clear it before the fire arrives. That means continuous discovery, inventory, reachability, and business context - at AI speed combined with human judgment. The same AI that found these flaws is the best tool defenders have to get ahead of the next ones. Tenable Research’s FAQ, updated as this develops: https://lnkd.in/dUaVyNUq #ExposureManagement #AI #PHP2Shell

I recently built an AI SRE agent for a client but it almost got hacked. The agent could investigate incidents, access infrastructure, and take corrective actions. Basically, an SRE that never sleeps. It was doing exactly what we had given it permission to do. - It could access the logs. - It could execute commands. - It could restart services. - It could make changes. - The permissions were restricted. - The access was authenticated. But we still ran into a problem. A malicious prompt injection (an instruction hidden in something the agent was reading) could influence what it decided to do next. The agent wasn't compromised. Nobody stole its credentials. It was simply being influenced by something it was supposed to treat as data. That's when I realized one of the biggest challenges with AI agents isn't just what they're allowed to do, it's what they can be convinced to do. A prompt injection can manipulate an agent into using its legitimate permissions in ways you never intended. I started looking at: → Short-lived, just-in-time access → Strong agent identity → Ephemeral runtimes → Continuous enforcement → Complete auditability → Constraining agent autonomy I figured out Teleport can help me fix this. Instead of giving an agent permanent access to infrastructure, you can build around identity-based, short-lived access and strong session-level visibility. The bigger realization: Zero Trust tells us not to trust the agent by default. Agent Trust asks what happens after we've authenticated it and given it permission to act. That's a very different problem. There is a detailed white paper from Teleport called “From Zero Trust to Agent Trust” that goes deep into this. I learned quite a few things from it, especially around securing autonomous agents operating infrastructure. If you're building AI agents that can touch production, this is worth reading. https://fandf.co/4zU2Qfb Huge thanks to Teleport for making this wonderful resource available and also collaborating on this post.

Most enterprises now have more machine and agent identities than people, and a large share have already had a breach tied to one. That is a part of the AI agent boom most organizations are still grappling with. We are deploying NHI’s at a scale no human team can track, and we’re handing them the exact thing we spent a decade trying to get rid of, which is long-lived static credentials and standing privileges. Now, an overprivileged agent can exfiltrate data at machine speed all without anyone ever phishing a human. OAuth grants, API tokens, and service accounts are the connective tissue of modern infrastructure, and agents depend on every one of them, and a quarterly access review does very little against something that acts in milliseconds. Agent identity must be treated with the same rigor as human identity, favoring short-lived credentials over static secrets and demanding full auditability of what every agent did and why. That is the shift Resilient Cyber partner Teleport frames as moving from Zero Trust to Agent Trust. Give it a read if you're putting agents into production -> https://fandf.co/4fSCD7E #Sponsored

A full commit SHA pin can still run an attacker's code. Yes, you read it right. Forks share their parent's object store, so a fork-only commit is reachable through the original project's name. SHA pinning checks validity, not provenance. Don't get me wrong: pinning to a SHA commit is still a good practice, but for today's threat landscape that is not enough to secure your CI/CD. The good news is that Chainguard Actions is now GA: actions rebuilt from verified source, hardened, and continuously re-evaluated. I talked a bit about this in this short video! I will also be running 2 webinars about the topic in the upcoming weeks. Two opportunities to learn about securing your GitHub Actions beyond SHA pinning! I'll share the links to both webinars in the comments. #GitHubActions #SupplyChainSecurity #DevSecOps

What changes when email is finally managed as infrastructure instead of four separate jobs? You stop finding out about problems from your customers. A DNS issue is caught before it breaks authentication. A reputation slip is flagged before delivery drops. An unknown sender is surfaced before enforcement blocks your own mail. The failures that used to take weeks to trace become something you see as they start.That is the shift we built the platform for. Not more dashboards. Earlier answers. This is what it looks like: www.easydmarc.com/platform #EasyDMARC #EmailSecurity #EmailTrust #EmailInfrastructure

I had a conversation with a customer this week that changed how I think about resilience. We were talking about a telecoms provider. It serves millions of customers, but that's only half the story. Hundreds of other phone companies sell services on top of its network. Different brands. Different websites. Different customers. But no infrastructure. If the network goes down, every one of those businesses loses its product at exactly the same moment. It made me realise something. As CISOs, we're obsessed with mapping who can take us down... 🧨 Third parties. 🧨 Fourth parties. 🧨 Supply chain risk. We rarely ask the opposite...Who can't operate until we come back? That's the real dependency chain. Your resilience plan shouldn't stop at your front door. It should include every customer, partner and reseller whose business depends on yours. 𝗕𝗲𝗰𝗮𝘂𝘀𝗲 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗶𝘀𝗻'𝘁 𝗷𝘂𝘀𝘁 𝗮𝗯𝗼𝘂𝘁 𝗵𝗼𝘄 𝗾𝘂𝗶𝗰𝗸𝗹𝘆 𝘆𝗼𝘂 𝗿𝗲𝗰𝗼𝘃𝗲𝗿. 𝗜𝘁'𝘀 𝗮𝗯𝗼𝘂𝘁 𝗵𝗼𝘄 𝗺𝗮𝗻𝘆 𝗼𝘁𝗵𝗲𝗿 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀𝗲𝘀 𝗮𝗿𝗲 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝘆𝗼𝘂 𝘁𝗼. Book your Resilience Assessment: https://lnkd.in/ejrFmQDb

Every board should ask how prepared the business is for a world where AI has lowered the barrier to sophisticated cyberattacks. Anthropic's new threat intelligence report (link in comment) makes that concrete: eight months of documented misuse, from state espionage to financially motivated fraud. The techniques nation-states once needed a team of specialists to run are now available to any criminal with an AI agent and a stolen API key. That's not a nation-state problem. It's a problem for every company with code and data worth stealing. As these models grow more capable, risk grows with them. That raises the bar for application security specifically. The code running organizations is where these threats land. To address it, AI companies and defenders must work together. That's why we continue to invest in security research through our Checkmarx Zero team, and why we recently joined Anthropic's Project Glasswing and launched Checkmarx Fusion. We're using Claude Mythos 5 to strengthen our own vulnerability detection. We're finding issues before anyone else does. And we're sharing what we learn with the industry. https://lnkd.in/gssVHRu7

When I look at customer trends, read the news about breaches, one trend that is clear - Blindly restoring a #backup after an identity breach can trigger your next incident. Attackers (humans and NHIs) who log in with valid credentials don’t go rouge right away. They quietly set themselves up to stay: shadow admins, tweaked conditional access policies, rogue OAuth permissions. Restore an unverified snapshot and you put all of it back into production. Same backdoors. Same attacker. Round two. Recovered isn’t the same as trusted. What matters is "Mean Time to Good State": how fast you get back to an environment you can trust. Getting past “restore and hope” takes: * Behavioral insight that maps human and non-human activity to known attacker techniques * A clear view of impact and blast radius * Containment and #recovery recommendations backed by evidence. Less guesswork, faster response, a shorter "Mean Time to Good State". Really proud of what our team built here. See how Druva Identity Resilience breaks the reinfection loop: https://ow.ly/FQLj50ZOWwe #IdentitySecurity #CyberResilience #IncidentResponse #ZeroTrust #Druva

GOTTA PROBLEM??? yes, yes you probably do have a problem. if: a) you’re using AI agents and just hit “approve” when they ask for permissions, praying for the best, or b) you dont use agents because “what if I’m the next public AI incident”. but not with Cakewalk.

The new MCP standard is very important for anyone who's connecting agents with apps. the Agentic AI Foundation recently released a new MCP standard (V2026-07-28) so here's our read: WHATS NEW: the V2 moves to a stateless protocol core, removing the initialization handshake and protocol-level sessions. Requests become self-contained, making MCP much closer to a standard HTTP workload. OUR TAKE: Good change. Once the ecosystem converges on the new standard, this significantly simplifies MCP infrastructure: no sticky sessions or shared session stores, easier horizontal scaling and recovery, and cleaner routing and authorization, particularly valuable for gateways. BUT it's more promise than control: (tbc in the comments)

Vorige week op de ONE Conference kreeg ik een vraag die vaker voorbij komt: waarom past Microsoft niet gewoon zero trust toe? Mijn antwoord en de onderbouwing erbij heb ik uitgeschreven, alsmede drie #BEC-signalen die in #Microsoft365 een lage severity krijgen: een doorstuurregel in outlook, een hergebruikt sessie token vanaf een andere locatie en een eDiscovery zoekopdracht naar "factuur". Alledrie die handelingen worden gezien. Maar de lage severity zorgt ervoor dat niemand ernaar kijkt. Lees het hier: https://attc.to/becblog Ben benieuwd: wat doen jullie met informational/low alarmen?

🚨 𝗙𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗰𝗿𝗶𝗺𝗲 𝗵𝗮𝘀 𝗴𝗼𝗻𝗲 𝗼𝗻-𝗰𝗵𝗮𝗶𝗻. 𝗛𝗮𝘃𝗲 𝗼𝘂𝗿 𝗶𝗻𝘃𝗲𝘀𝘁𝗶𝗴𝗮𝘁𝗶𝘃𝗲 𝗰𝗮𝗽𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗰𝗮𝘂𝗴𝗵𝘁 𝘂𝗽? 🔎 👀 𝗟𝗮𝗱𝗶𝗲𝘀 𝗮𝗻𝗱 𝗴𝗲𝗻𝘁𝗹𝗲𝗺𝗲𝗻: 𝗻𝗼𝘂𝘀 𝗮𝘃𝗼𝗻𝘀 𝘂𝗻 𝘀𝘂𝗷𝗲𝘁! It’s no longer enough to ask who owns the wallet. We need to understand where funds came from, how they moved, which liquidity pools they touched, and whether seemingly legitimate transactions are connected to illicit activity. While we're all busy discussing MiCA, DORA, AML/CFT frameworks, and supervisory expectations, illicit funds are moving across wallets, protocols, and liquidity pools at impressive speed. Très chic. Très inconvenient. This raises some important questions: 👇 𝗪𝗵𝗲𝗿𝗲 𝗱𝗶𝗱 𝘁𝗵𝗲 𝗳𝘂𝗻𝗱𝘀 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗰𝗼𝗺𝗲 𝗳𝗿𝗼𝗺? Because “I received it from another wallet” is not exactly the most compelling source-of-funds explanation. 💸 𝗪𝗵𝗲𝗿𝗲 𝗱𝗶𝗱 𝘁𝗵𝗲𝘆 𝗴𝗼 𝗻𝗲𝘅𝘁? Following funds across multiple protocols can feel like investigating a crime scene where someone has helpfully rearranged all the furniture. 🕵️ 𝗔𝗻𝗱 𝘄𝗵𝗮𝘁 𝗿𝗼𝗹𝗲 𝗱𝗶𝗱 𝗹𝗶𝗾𝘂𝗶𝗱𝗶𝘁𝘆 𝗽𝗼𝗼𝗹𝘀 𝗽𝗹𝗮𝘆? Because apparently, even money laundering has discovered DeFi. 👀 𝗝𝗼𝗶𝗻 𝘂𝘀 𝗳𝗼𝗿 𝗮 𝗰𝗼𝗻𝘃𝗲𝗿𝘀𝗮𝘁𝗶𝗼𝗻 𝗼𝗻 𝗽𝗼𝗼𝗹 𝗿𝗶𝘀𝗸: 🔗 https://lnkd.in/eYZfu3Ur Because criminals already collaborate across borders. Perhaps the people chasing them should, too. Corporate compliance is glamorous. Until the transaction graph has 47 hops. Hypernative 🔥

Rilevamento delle frodi e responsabilità: quando i controlli falliscono, intervengono i tribunali. Maggio 2023. Un trojan travestito da aggiornamento di Chrome. Alle 04:46, il malware prende il controllo del dispositivo e trasferisce 2.700 euro su un conto mai utilizzato. La banca rifiuta il rimborso, sostenendo che la Strong Customer Authentication era attiva. Il Giudice di Pace di Empoli non è d'accordo. Rimborso, spese legali, sanzione per la mediazione mancata (sentenza n. 32/2026). Come nota Alberto Bozzo, questo è il caso facile. Il caso difficile arriverà quando la banca avrà davvero un motore antifrode, e quel motore dirà "sì" a un pagamento manipolato. Lì, la responsabilità non è disciplinata dall'AI Act, che esclude esplicitamente il rilevamento delle frodi dalla categoria ad alto rischio. La decidono quattro norme più vecchie: PSD, Codice Civile, DORA, GDPR; l'analisi di Bozzo ne mappa il territorio con precisione. E le RTS sulla SCA, in vigore dal 2019, stanno diventando lo standard con cui i giudici misurano lo "stato dell'arte". Il problema: quello standard misura la transazione, non la persona. Non cattura un cliente che autorizza consapevolmente un pagamento perché è stato manipolato a farlo. Il divario tra "conforme" e "ha davvero rilevato la manipolazione" sta per diventare un problema in tribunale, non solo sulla carta. Ho scritto l'analisi completa, partendo dal lavoro di Alberto Bozzo, con tutti i riferimenti normativi. #FraudPrevention #PSR #DORA #AIAct #ComplianceBancaria

Three things stood out for me while I was researching the latest wave of Firebase-enabled scam campaigns. 1- Trusted cloud infrastructure has become part of the fraud stack: Attackers are abusing its credibility to host malicious infrastructure. 2- This is not one campaign or one country: Distinct malware operations in India, Indonesia, Brazil and elsewhere are converging on the same approach. 3- AI can connect the dots across the attack chain: From phishing pages to malware code and live attacks, the concern is when these capabilities become one automated pipeline. As always, detection and response will need to adapt at the same speed as the attacks. Read the full blog: https://lnkd.in/e4dWapxs #FraudPrevention #Cybersecurity #Scams #AI #FinancialCrime BioCatch

AI is going to kill us all. We have to slow down ... BUT first here's 3 simple tips on to bypass GLM-5.3's guardrails to do malicious things. Thanks Anthropic! These PSAs are not making the world safer place.. (1) Providing a deceptive prompt, such as telling the model that it is an autonomous red-team agent working on an exercise. This gets GLM-5.3 to engage 64% of the time. (2) Prefilling the models’ thinking tokens so that it appears to have considered the user’s request and decided to proceed. This gets GLM-5.3 to engage 92% of the time. (3) Using an abliterated version of the model, as described above. This gets GLM-5.3 to engage 100% of the time. #DarkArts #Abliteration #RedTeaming #TipsAndTricks

De auto is volgeladen, de kinderen zitten achterin en iedereen heeft zin in de vakantie. En dan sta je op het vakantiepark eerst een half uur in de rij bij de receptie. Joe Bloemendaal van Novico Identity Solutions schetste dat beeld, en ik herken het meteen. Niemand wordt 's ochtends wakker met zin om aan zijn toegang en identiteit te werken. Toch moet het geregeld worden, want de regels worden alleen maar strenger. Het gaat vooral mis op de momenten dat er iets verandert: een medewerker die begint of vertrekt, of een nieuwe gast die aankomt. Als je dat automatiseert, maak je het niet alleen veiliger. De gast rijdt door naar zijn huisje en kan meteen aan zijn vakantie beginnen. En de medewerker achter de balie hoeft geen pasjes en sleutels meer uit te delen, maar kan echt gastheer of gastvrouw zijn.

Sometime when we think about resilience we only see what's immediately in front of us and not the wider landscape so before you spend another $1 on resilience, tell me what actually matters that isn't right in front of your face. All of it?! A company recently told me they had to temporarily halt US production following a ransomware attack. Think about what “restart production” actually means in a business like that. Applications have to work. Infrastructure has to work. Identity and data have to be available. Operational technology matters. So do the third parties sitting somewhere in that chain. Miss one critical dependency and your recovery plan can look great while the business is still standing still. This is where I think we're spending resilience budgets in the wrong order. Cyber spending grew 12% last year according to Boston Consulting Group (BCG), with more than 80% of the security leaders they surveyed continuing to increase budgets into 2027. More money is coming. I'd spend the first part of it on understanding the business. Pick the process that absolutely has to restart after an attack. Map every application, identity, dataset, piece of infrastructure and external service it needs to function. Then decide where the resilience investment goes. That's how I think about Minimum Viable Business at Gambit Security. Start with what makes the business run, understand everything underneath it, then use that evidence to decide what deserves your time and money. Otherwise we risk spending more on resilience without actually knowing what we're trying to keep alive. Book your Resilience Assessment: https://lnkd.in/eiMCnq9b

🔐 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐀𝐰𝐚𝐫𝐞𝐧𝐞𝐬𝐬 𝐢𝐬𝐭 𝐦𝐞𝐡𝐫 𝐚𝐥𝐬 𝐒𝐞𝐧𝐬𝐢𝐛𝐢𝐥𝐢𝐬𝐢𝐞𝐫𝐮𝐧𝐠. Sie ist Teil unternehmerischer Verantwortung. Der «European Cyber Security Month» rückt im Oktober europaweit Cyber Security und den bewussten Umgang mit digitalen Risiken in den Fokus. Für mich ist das ein guter Anlass, eine Frage zu stellen, die auf die Agenda jeder Geschäftsleitung gehört: ❓𝐖𝐨𝐫𝐚𝐧 𝐞𝐫𝐤𝐞𝐧𝐧𝐞𝐧 𝐰𝐢𝐫, 𝐨𝐛 𝐮𝐧𝐬𝐞𝐫𝐞 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐀𝐰𝐚𝐫𝐞𝐧𝐞𝐬𝐬 𝐭𝐚𝐭𝐬ä𝐜𝐡𝐥𝐢𝐜𝐡 𝐰𝐢𝐫𝐤𝐭? Nicht allein an Abschlussquoten oder der Klickrate einer Phishing-Simulation. Entscheidend ist, wie Mitarbeitende handeln, wenn es darauf ankommt: ▶️ Melden sie verdächtige E-Mails – auch nach einem unbedachten Klick? ▶️ Sprechen sie Unsicherheiten frühzeitig an? ▶️ Funktionieren Meldewege auch unter Zeitdruck? ▶️ Wissen sie, was bei einem Sicherheitsvorfall zu tun ist? Für mich zeigt sich genau hier, ob Security Awareness wirklich Teil der Unternehmenskultur ist – oder am Ende doch nur ein Pflichtprogramm bleibt. Fehler werden sich nie vollständig verhindern lassen. Entscheidend ist deshalb, wie gut eine Organisation darauf vorbereitet ist und wie handlungsfähig sie bleibt, wenn etwas passiert. 𝐃𝐢𝐞 𝐔𝐦𝐬𝐞𝐭𝐳𝐮𝐧𝐠 𝐯𝐨𝐧 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐀𝐰𝐚𝐫𝐞𝐧𝐞𝐬𝐬 𝐥ä𝐬𝐬𝐭 𝐬𝐢𝐜𝐡 𝐝𝐞𝐥𝐞𝐠𝐢𝐞𝐫𝐞𝐧. 𝐃𝐢𝐞 𝐕𝐞𝐫𝐚𝐧𝐭𝐰𝐨𝐫𝐭𝐮𝐧𝐠 𝐝𝐚𝐟ü𝐫 𝐧𝐢𝐜𝐡𝐭. Wirksame Security Awareness beginnt deshalb bei der Führung. Regulatorische Anforderungen wie NIS2 unterstreichen diese Verantwortung für betroffene Organisationen zusätzlich. Mitarbeitende müssen Risiken einordnen und in kritischen Situationen angemessen handeln können. Gleichzeitig müssen Organisationen aus Simulationen, Meldungen und realen Vorfällen lernen. Ziel sind nicht fehlerfreie Mitarbeitende, sondern widerstandsfähige Organisationen. Und genau diese Widerstandsfähigkeit ist eine Führungsaufgabe. Wie wird Security Awareness in eurem Unternehmen gesteuert: als jährliche Pflichtübung – oder als Bestandteil der unternehmerischen Resilienz? Am 22. Oktober zeigt Sarah Mühlemann, Cyber Security Consultant bei InfoGuard AG, in unserem Webinar, wie menschenzentrierte Security Awareness in der Praxis funktioniert und wie daraus eine nachhaltig gelebte Sicherheitskultur entsteht. Den Link zur Anmeldung findet ihr im Kommentar. 👇

When information is compromised, you can recover it. When value is compromised, the loss may be irreversible. Digital assets have fundamentally changed the stakes of network security. The internet moved data, but blockchains moved value. That distinction is the bedrock of everything we build at CertiK. When we founded CertiK in 2017, we believed security had to start from the first line of code, while security and compliance had to extend across the full lifecycle. Formal verification gave us a rigorous technical foundation. As the digital asset ecosystem grew, our work expanded to include security auditing, continuous monitoring, risk intelligence, AI-driven security, and compliance. This evolution is the thinking behind CertiK’s refreshed brand. The digital economy needs a continuously operating risk management system that helps identify risk, supports proactive governance, and gives regulators, institutions, and innovators greater confidence to participate. Our long-term goal is to build a global risk management and trust platform for the digital economy. The internet era was built on networks that moved information. The next era will depend on infrastructure that allows value to move securely. That is what we mean by building the trust infrastructure for the digital economy.

There's probably more security data stored in Amazon S3 than anywhere else on earth. Most of it never sees the light of day in the average SOC. Security teams were wise to retain it, but using it takes a data engineer they often don't have, so we've built one into the Query product. Query Accelerated Connectors launched today. Point us at an S3 bucket, and that data joins everything else on the Query Security Data Mesh. Your analysts and agents can use all of it for the investigations, threat hunting, detections and incident response work they do every day. It's priced based on the data volume you choose to retain. Most of your data should still stay right where it lives, but sometimes you need a place to store it. Federate when possible. Accelerate when necessary. Built for the security data teams store in AWS. More details on the launch in the first comment below. AWS Partners

Somewhere right now, an MSP is configuring Intune, locking down SharePoint, and getting a client ready for Copilot, and it’s nowhere on their invoice. 😱 This is a HUGE missed opportunity. Clients are making this easier. The security brief used to be youre the expert, just help me out. Now they walk in with a framework name: I need CMMC Level 1. Were a HIPAA shop, how do we prove our controls? A named framework comes with a defined scope, and work with a defined scope can be packaged, repeated, and priced. Thank you to CJ Fairfield at CRN for the great conversation about this, along with whats coming next at Augmentt (deeper policy baselines, automated remediation, compliance framework support) and how our team of about 40 uses AI internally. Monetize your services and get paid for the work you’re already doing! https://lnkd.in/gbtu9xvQ

The question I ask on nearly every discovery call now: walk me through what happens when a customer loses access to their account. The answers have a pattern. Security questions someone set four years ago. A call to a contact centre where an agent asks for a date of birth and a partial address. Sometimes a full document check, run from scratch, on a customer the institution verified thoroughly eighteen months earlier. Everyone in the room knows it is the weak point. It is usually the flow nobody owns outright, which is why it stays as it is. That is the gap I spend most of my time on, and it is why one line in the KuppingerCole Analysts Leadership Compass — Identity Verification 2026, matters more to me than the designation: the ability to bind a completed verification to the authentication credential a customer uses afterwards, so the proof you already have is available when they come back. Not a new check, just the same one, still working. (You can grab a free copy of the report from the Ditto website - link is in the comments)

I often get the question why CR Group doesn't consolidate all operations under one single brand. It's a fair question. The conventional logic in tech is that a unified brand builds faster, sells easier, scales cleaner. From our perspective, and by extension when it comes to European sovereignty, it is not that simple. We are not serving conventional customers. The nationally critical customers Tutus Data serves in Sweden have spent years building trust with Tutus Data , trust earned through certifications, through track record, through understanding the specific threat environment of a Nordic NATO member. The nationally critical customers of Sentyron in the Netherlands have done the same. That trust doesn't transfer easily. It lives in the team, in the relationships, in the product history. Folding our operations under one single CR Group brand wouldn't make us stronger. It would risk diluting the essence of what makes each company trusted. Sovereign European security infrastructure will not be built by one company or one brand. It will be built by a network of trusted specialists each rooted in their own markets, all pointing in the same direction. Thats the model were building. An industrial group of defence tech companies within secure communication.

Most identity products still treat verification and authentication as two separate problems. Prove who someone is at onboarding. Then, separately, check they hold a credential every time they come back. The two never meet, and the assurance you paid for at the start stops being worth anything. At Ditto we have never accepted that split. It is the reason our products are built the way they are, and it has not always been the easy story to tell — a one-off check is a cleaner product to sell than continuity. KuppingerCole Analysts has now named Ditto a Product Leader in the Leadership Compass — Identity Verification 2026, and the binding of verified identity to high-assurance authentication is among the key things singled out. I am proud of the team for it, and clear-eyed about how much is still ahead of us. Thank you to everyone who got us here, and to the customers who pushed us to toward it. Read the full report, including how KuppingerCole Analysts assessed us, via the link in the comments. #continuousidentity #digitalidentity #highassuranc