LinkedIn thought leader ad examples

Chinese models have well and truly cemented themselves as real contenders on both security performance and cost. The testing we're doing is showing shocking results. As I discussed with Paul Smith @ The Australian Financial Review: "As the availability of these models improves, these attacks will move from negligent friendlies, to real criminals and nation-state actors". The full article if you're interested And the full article for those interested -https://lnkd.in/g-FBcjCP Latest model research - https://lnkd.in/gMtVQNBf

The hardest part of detecting data center opposition risk isn’t finding bots. It’s knowing when opposition is organic, and when something else is driving the conversation. Our RAV3N Research team analyzed 770,000 posts across 8 narratives tied to 5 hyperscalers. What we found was not in the volume. It was in the behavior: • 93–98% of state-aligned posts were reshares, not original content • 42–50% bot-like activity within those ecosystems, versus a 32–37% baseline • 28.4% bot-like behavior at the project level, concentrated at the network’s edges With 70% of Americans now opposing local data center expansion, and opposition projected to block or delay $225B+ across 75+ U.S. projects in 2026, understanding the behavior behind the narrative matters. Read the full analysis: https://bit.ly/4jrmKbo

This recent report, Why CISOs Must Focus On Narrative Attacks, in collaboration with TAG Infosphere CEO Dr. Edward Amoroso and BLACKBIRD.AI CEO Wasim K., covers: • Why narrative attacks belong in the CISO's risk portfolio • How generative AI and agentic AI have reduced the cost of coordinated influence campaigns to near zero • Five recommendations for security leaders to integrate narrative intelligence into their security operations Thank you to Ed Amoroso and the TAG Infosphere team for recognizing narrative intelligence as a top priority for CISOs. Read the report here: https://bit.ly/3RXXZZr

💡 Les attaques s'accélèrent avec l'IA. Nos processus de gestion des vulnérabilités, eux, sont souvent restés les mêmes. 🔍 Toujours plus de scans. 📈 Toujours plus de CVE. 📊 Toujours plus de tableaux de bord. Pourtant, les équipes sécurité disposent toujours des mêmes ressources pour réduire le risque. Face à des attaquants dont les capacités sont démultipliées par l'IA, la réponse n'est pas de produire davantage de rapports. ✅ La réponse est de prioriser mieux, décider plus vite et agir plus efficacement. C'est toute la promesse du VOC. 🎙️ Le 29 septembre, je partagerai ma vision de cette évolution : passer du simple scan de vulnérabilités à une approche plus continue, contextualisée et orientée action, capable de répondre au rythme imposé par les attaques modernes. #Cybersécurité #VOC #CTEM #AI

🥷🏿 Le Shadow AI est probablement déjà dans votre entreprise, vous ne le voyez juste pas. Assistants IA non validés, données collées dans des chatbots publics, agents branchés au SI... L'OWASP place déjà les risques agentiques dans le Top 3 de son classement LLM 2026. Interdire ne marche pas ; encadrer, si. Le 29 septembre, je vous montre comment identifier les usages de Shadow AI et surtout comment les encadrer. 30 min, pour y voir plus clair. 👉 Lien d'inscription en commentaire

Onder de Cyberbeveiligingswet (de Nederlandse NIS2-wet) kunnen bestuurders 𝐩𝐞𝐫𝐬𝐨𝐨𝐧𝐥𝐢𝐣𝐤 𝐯𝐞𝐫𝐚𝐧𝐭𝐰𝐨𝐨𝐫𝐝𝐞𝐥𝐢𝐣𝐤 gesteld worden. Dat klinkt zwaar, maar voor de infosec professionals onder ons is het ook een kans. Het onderwerp moet nu ook op de bestuurstafel komen. Manage dat goed en dan volgen tijd en budget meestal vanzelf. Dit fragment komt uit mijn gratis webinar over NIS2/Cbw voor Cyberday. De volgende is a.s. 𝐰𝐨𝐞𝐧𝐬𝐝𝐚𝐠 𝟑𝟎 𝐬𝐞𝐩𝐭𝐞𝐦𝐛𝐞𝐫 om 09:30. Registreer je nu! Link in de reacties 👇 Leeft informatiebeveiliging bij jullie al op bestuursniveau? #informationsecurity #NIS2 #Cyberbeveiligingswet #governance

AI doesn’t live in one place. And AI agent security is becoming an insider risk problem. Follow the work wherever it runs.

CMMC is coming, and now we have the date! With the CMMC 48 CFR final rule published, the program officially takes effect on November 10, 2025. From that day forward, CMMC requirements will begin phasing into DoD contracts. The challenge? The Cyber AB trends point to a looming White Walker style backlog. Our analysis shows only 14-20% of Level 2 contractors are expected to complete their assessments before CUI requirements kick in, leaving most of the realm queueing for scarce auditor openings. The advantage of moving early: Contractors who mobilize now get certified before the crowd and stand a better chance of priority in new DoD awards. Three-Eyed Raven view: See our bottleneck projection here: https://lnkd.in/eJUgWWvJ #DFARS #CMMC #DOD #GovCon

𝐂𝐲𝐛𝐞𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬: Die Cyberbedrohung wächst nicht nur. Sie industrialisiert sich. 2025 verändert die Spielregeln für Cyberresilienz. Allein im vergangenen Jahr bearbeitete das InfoGuard CSIRT über 350 Cybervorfälle. Rund 20 (!) Prozent mehr als im Vorjahr. Was wir bei InfoGuard AG feststellen: Noch entscheidender als die Anzahl ist die Veränderung dahinter. Cyberangriffe werden heute deutlich professioneller organisiert, effizienter durchgeführt und massiv skaliert. Cyberkriminelle arbeiten zunehmend wie moderne Unternehmen: mit arbeitsteiligen Strukturen, automatisierten Werkzeugen, KI-gestützten Angriffen und professionellen Ransomware-Ökosystemen. 👉 Cybercrime entwickelt sich zum industrialisierten Dienstleistungsmodell. Dies verändert die Ausgangslage fundamental. Die Frage lautet längst nicht mehr, ob ein Unternehmen angegriffen wird. Entscheidend ist vielmehr: Wie früh erkennen wir relevante Bedrohungen und wie vorbereitet sind wir wirklich? Genau hier spielt Cyber Threat Intelligence eine Schlüsselrolle. Sie unterstützt den Schritt von reaktiver Sicherheit zu proaktiver Cyberresilienz und wird zum Führungsinstrument für bessere Entscheidungen. Richtig eingesetzt, hilft Cyber Threat Intelligence: ✅ relevante Risiken frühzeitig zu erkennen und richtig zu priorisieren. ✅ die eigene Bedrohungslage kontinuierlich einzuordnen, und zwar abgestimmt auf Branche, Geschäftsmodell und kritische Abhängigkeiten. ✅ Investitionen und Schutzmassnahmen faktenbasiert zu steuern. Aus meiner Sicht ergeben sich daraus drei zentrale Handlungsfelder für die oberste Führungsebene: 1️⃣ Verlangt ein regelmässiges, verdichtetes Cyber-Lagebild in Business-Sprache und nicht primär technische Reports. 2️⃣ Verknüpft Cyber-Threat-Intelligence-Erkenntnisse mit eurem Risikomanagement: Welche Geschäftsprozesse, Lieferketten oder Wertschöpfungsbereiche wären im Ernstfall betroffen – und was heisst dies für unser Business? 3️⃣ Prüft kritisch, ob euer Security Operations Center (SOC) und euer Incident-Response-Team (CSIRT) diese Informationen tatsächlich nutzen, oder ob sie isoliert in Reports enden, statt Risiken zu reduzieren. 𝐌𝐞𝐢𝐧 𝐅𝐚𝐳𝐢𝐭: Reaktive Sicherheit reicht nicht mehr aus. Entscheidend wird die Fähigkeit, Bedrohungen frühzeitig zu erkennen, geschäftlich einzuordnen und vorbereitet zu handeln – strategisch, organisatorisch und operativ. Wer Cyber Threat Intelligence richtig nutzt, verbessert nicht nur seine Cyberabwehr, sondern seine unternehmerische Resilienz. Wenn ihr Cyber Threat Intelligence in eurem Unternehmen strategischer verankern wollt, lohnt sich ein Blick in unser neues Whitepaper «Threat Intelligence Insights». Den Link findet ihr im Kommentar. 👇

Die meisten Unternehmen investieren heute mehr in Cyber Security als je zuvor. Doch die entscheidende Frage ist nicht, wie viel investiert wird. Sondern wie resilient die Organisation tatsächlich ist. 👉 Wie gut ist eure Organisation auf die aktuelle Cyberbedrohungslage vorbereitet – fachlich, organisatorisch und strategisch? Diese Frage gehört längst nicht mehr nur auf die Agenda von CIOs und CISOs, sondern auch von Geschäftsleitung und Verwaltungsrat. 𝐃𝐢𝐞 𝐄𝐧𝐭𝐰𝐢𝐜𝐤𝐥𝐮𝐧𝐠 𝐝𝐞𝐫 𝐥𝐞𝐭𝐳𝐭𝐞𝐧 𝐉𝐚𝐡𝐫𝐞 𝐳𝐞𝐢𝐠𝐭 𝐝𝐞𝐮𝐭𝐥𝐢𝐜𝐡: Cybervorfälle werden häufiger, professioneller und geschäftskritischer. Gleichzeitig stehen Führungsgremien vor der Herausforderung, Risiken richtig einzuordnen, Prioritäten zu setzen und im Ernstfall handlungsfähig zu bleiben. Genau darüber sprechen wir an der 16. InfoGuard Security Lounge am 24. Juni 2026. Teilnehmende erhalten Einblicke in aktuelle Erkenntnisse aus unserem Cyber Defence Center (CDC), unserem CSIRT und unserem Red Team – verdichtet auf die Fragestellungen, die für Geschäftsleitung und Verwaltungsrat wirklich relevant sind: ▶️ Wie lassen sich Cyberrisiken in einer KI-geprägten Bedrohungslandschaft besser priorisieren? ▶️ Welche Risiken entstehen durch KI, Cloud, Remote Work und verteilte Infrastrukturen und wo ist eure Organisation heute tatsächlich angreifbar? ▶️ Wie lassen sich kritische Schwachstellen identifizieren und priorisieren, bevor daraus ein Sicherheitsvorfall entsteht? ▶️ Welche Erkenntnisse aus Incident Response, Threat Intelligence und Pentesting sind für die Unternehmensführung wirklich entscheidend? Wer Verantwortung für Cyberresilienz trägt, erhält praxisnahe Einblicke, konkrete Handlungsempfehlungen und neue Perspektiven für die eigene Organisation. Ich freue mich auf den Austausch mit Führungskräften, die Cyberresilienz aktiv gestalten wollen – vor Ort oder online. Die Details zur Agenda und den Anmeldelink findet ihr im Kommentar. 👇

Point-in-time workforce IDV is running out of road. We just updated our analysis of the 153M+ driver’s-license story. IDScan.net has now confirmed that identity data may have been accessed or copied from its systems. Which raises a very simple question: If the documents used to verify people can themselves be stolen, what does a successful ID check actually prove during an impersonation attack? It can prove the identity is real. It does not prove the human using it is the right person. That is the problem with treating a one-time identity check as the trust decision. Stronger credentials matter. Better verification matters. But in workforce security, passing IDV can no longer be the end of the conversation. The control has to move from “was this identity verified?” to “is this actually the expected person, right now?” Updated analysis: https://lnkd.in/g7HTak37

What gives a small biometric company an edge against industry giants? While companies like Idemia and Thales operate as large corporations, we compete through flexibility. Our independence gives us two advantages consistently praised by customers: 👉 First, ease of integration. Our components work with your systems, not against them 👉 Second, user experience focus. We optimize for humans, not just security protocols Being smaller means being more responsive. When customer needs change, we adapt quickly. In biometrics, this adaptability often matters more than size.

Identity security threats continue to dominate the headlines. The best way to prevent social engineering of the IT Helpdesk, credential phishing, and legacy MFA (PUSH, OTP) bypass, is to follow best practices that align with zero trust. Check out our guide here - https://lnkd.in/gMGbKzaT

Phishing and social engineering is a pandemic in the security industry. Luckily there is a cure and it's called Enterprise Passkeys. Consult your CISO before making any major changes to your authentication strategy. Use only as directed and never fall back to a phishable factor. To learn more, check out this brief - https://lnkd.in/eqrSTcQ6

Co-developing products with strategic design partners has always enabled the product team at HackerOne to quickly visualize what a Minimum Lovable Product (MLP) will look like and rapidly refine it to become even more lovable. One particularly special design partner is our own security team. Of course, we drink our own champagne. We affectionately refer to them as Customer Zero. Today, Customer Zero shares a significant milestone achieved through the features and technologies we co-developed. The highlight: 91% accurate automated routing in exposure management, utilizing recent agentic AI capabilities in Hai, Automations, and the newly upgraded Slack integration. Even more remarkable: 64% of all exposures are routed entirely autonomously to the correct remediation owners. This has resulted in substantial time savings for the team, which will be reinvested in strategic product security initiatives. This exemplifies the future of Continuous Threat Exposure Management (CTEM): agentic AI handles routine tasks and the so-called "busy work" that engineers and analysts often describe. Learn more about how we achieved this high-accuracy automation in the new blog by Martzen H.: https://lnkd.in/gmBWmTQx

More security teams are reevaluating how they validate vulnerabilities as attack surfaces expand and traditional testing methods can miss critical gaps. The Beginners’ Guide to Bug Bounty Programs is here—a practical breakdown of how modern organizations use bug bounties to strengthen security testing, increase coverage, and uncover issues that tools and scheduled assessments often overlook. The guide walks through the fundamentals, key decisions, and what to expect when launching your first program. If you’re exploring new ways to reduce risk and move faster, this is a strong place to start. 📘 Download the guide: https://bit.ly/3KSUuQd

Most of the AI conversation in cybersecurity is still too narrow. The real issue is not just what AI can generate. It is what it can access, trigger, accelerate and expose across an organisation. That cuts both ways. 1. Businesses are trying to adopt AI without losing control. 2. Security teams are also preparing for faster, more automated threats. That is why I am pleased to share Heimdal®’s latest announcement around AI Wingman and Third-Party AI Containment. It brings together two sides of the challenge: a) helping organisations contain and govern third-party AI use b) bringing AI into the platform to support guidance, investigation and stronger defensive operations This is the kind of direction the market needs more of. Less noise. More practical value. Proud to be part of taking this to market. #CyberSecurity #AI #ThreatDetection #SecurityOperations #SOC #ShadowAI #MSP #Heimdal #HeimdalAIWingman #AIWingman #AIWingmanAssist #AIWingmanTriage #AIWingmanSOC Morten Kjaersgaard Cosmin Toader Nabil Nistar Jesper Frederiksen Ken Yearwood

Heimdal #AI Wingman is coming out!. Assist, Triage and #SOC-AI. Defence against AI Attacks and vulnerabilities for Enterprises and MSP The #AI conversation has moved on. This is no longer just about chatbots and productivity gains. It is about what AI can access, what it can trigger, and how quickly both defenders and attackers can move with it. That is why we are expanding Heimdal’s AI direction with AI Wingman and Third-Party AI Containment. For us, this is about both sides of the challenge. Helping customers, such as Enterprises and #MSP's use AI more safely inside the business. And helping them defend faster as the threat landscape accelerates. We believe the right answer is not AI bolted onto the edge of the stack. It is AI built into the platform, where control, visibility and response already live. That is the direction we are building towards. https://lnkd.in/eKjkbeQp

We’re asking the wrong question about Mythos. Most of the conversation is: “What happens when attackers can find more vulnerabilities?” That matters. But it’s not the real issue. The real shift is speed. Ransomware operators don’t need Mythos to succeed. In most cases, they already have access. What’s changing is how fast they can move once they’re in. That window between detection and impact? It’s collapsing. And most defenses were built on the assumption that we had time. That’s the gap. We can keep getting faster at detection... Or we can accept the campaign is already in motion and build for what happens next. Because #ransomware was never just about initial access. It’s about what follows - and whether you can stop it. Mythos doesn’t rewrite that playbook. It just makes it run faster. Ryan Smith and I break down what this actually means - and where teams should really be focusing next. Read more on the Halcyon blog: https://lnkd.in/gP_kF6PK

Our latest GreyNoise research is out — the 2026 GreyNoise State of the Edge Report, covering H2 2025. The finding that keeps coming up in every conversation: 52% of remote code execution attempts came from IPs with no prior history in GreyNoise data 😮. More than half of the most dangerous exploitation hitting internet-facing infrastructure came from IPs with no prior history in GreyNoise data — infrastructure that may not appear on reputation feeds until after the exploitation attempt. But one chart 📊 in particular stopped us \(attached\). It shows CVE exploitation volume broken down by vulnerability age. The pattern is hard to ignore: pre-2015 CVEs — vulnerabilities over a decade old — generated 7.3 million exploitation sessions. That's 4x more than 2023-2024 CVEs combined, though one 26-year-old vulnerability \(CVE-1999-0526, X Server\) accounts for the majority. Even excluding it, Shellshock and PHP-CGI continue generating measurable traffic a decade later. The conventional wisdom is that patching programs should focus on the newest vulnerabilities first. The data tells a different story. Public exploit code for these vulnerabilities has been available for years, and the sustained traffic suggests they remain effective against systems that have quietly accumulated outside the patch cycle. Three other findings from the report that warrant attention: 👀 A residential botnet grew from 2,000 to 300,000 IPs in 72 days — a 150x increase, 73% residential. IP-based blocking, reputation scoring, and per-source rate limiting have limited effectiveness against this model. ‼️ Palo Alto GlobalProtect absorbed 16.7 million sessions — more than 3.5x Cisco and Fortinet combined. That notable concentration warrants investigation — whether it reflects available tooling, exposed attack surface, or targeted campaigns. 👿 A single hosting provider \(UCLOUD\) accounted for more malicious sessions than AWS and Azure combined — 14% of all observed sessions from one ASN. The full report 📓 covers edge infrastructure targeting, infrastructure concentration patterns, AI/LLM attack surface emergence, and actionable recommendations for security leadership and operations teams. Read the full research report here: https://lnkd.in/e8dueWPT Always happy to discuss or answer questions about the data — drop a line at [email protected].

We are very excited to be recognized as a Representative Vendor in the 2026 Gartner® Market Guide for Identity Governance and Administration. According to Gartner, “in 2026, IGA is evolving from legacy, quarterly cycles of manual access reviews to an autonomous, continuous, and outcome-driven process that encompasses both access certification and provisioning.” Explore the risks, opportunities, and recommendations shaping the future of IGA. #IdentityGovernance #IGA #IdentitySecurity https://lnkd.in/gMP9vKdn

Proud to see Pathlock named as a Representative Vendor in the 2026 Gartner Market Guide for Identity Governance and Administration (IGA)! Gartner puts it well: "in 2026, IGA is evolving from legacy, quarterly cycles of manual access reviews to an autonomous, continuous, and outcome-driven process that encompasses both access certification and provisioning." I lead Customer Engineering and Support at Pathlock, so I see that shift up close — customers moving off manual, periodic reviews toward continuous, outcome-driven governance. This recognition tracks with what I'm hearing from them every day. Read the full guide: https://lnkd.in/ezdAuu3f #IdentityGovernance #IGA #IdentitySecurity

Last month I posted about my 25 years of building every SIEM architecture, and then seeing it lose to the same problem: the data outgrew the architecture. See that evolutionary journey in the diagram below. And then let’s talk about the new architecture I am proposing. It is something I have been building and refining over the last 5 years. The new architecture flips the problem. We start by accepting that distributed, heterogeneous data is the natural environment. Don't impulsively / habitually move big data to your SIEM vendor. Rather, we add a federation layer in our security stack to make the data discoverable and addressable. The federation layer creates the metadata that describes each source, its location, its data, its schema, and the APIs to reach it. It connects and joins the relevant pieces from across the environment and returns results in one unified data model. Storage, indexing, retention, and scaling get decided per source, based on what each kind of data actually needs, instead of one bill for everything. At that point the SIEM isn't a repository anymore. It becomes what it was truly meant to be – a security analytics brain running on top of the environment that already holds the data. At Query, we call this architecture a Security Data Mesh. The best part: your legacy SIEM folds into it. So does your security data lake project and so does your EDR. All without needing a major data migration. You investigate everything in place, you cut the cost of moving and duplicating data, and your AI finally performs on your whole environment instead of the fraction you could afford to centralize. Let’s stop fighting to centralize and own the data. Instead, let’s make it work for us from within its natural environment. Let me know if you agree/disagree. This has already been quite an evolutionary journey and I would love to learn from your experiences. #SIEM #cybersecurity #data #secdataops #AgenticSOC

Excited to share that Anthropic just highlighted Artemis Security in their Claude Code Guide for Startups, a writeup on how the most AI-native companies operate. Artemis is the only cyber company featured in this list alongside a dozen of the world’s most AI-Native companies we admire including Cognition, Clay, ClickHouse, and Harvey. In the piece, we mention that everyone is racing to build AI products. Far fewer are rebuilding how their company actually runs. The second one is the much bigger unlock. Artemis runs as an AI-native company, not a company that happens to use AI. It's the reason we ship more than 5,000 PRs a week with a team a fraction the size of the incumbents. This allows us to deliver swiftly and reliably to protect F500 companies, Cursor, and many more enterprises, all to stop attacks at machine speed. Full guide in the comments.