LinkedIn thought leader ad examples

👨💻 Un analyste SOC passe trop de temps à faire ce qu'une machine ferait mieux : trier, corréler, documenter. La vraie promesse de l'IA, n'est pas de remplacer l’analyste, mais d’augmenter ses capacités pour qu’il se concentre sur l’investigation et la décision.. Le 30 septembre, je montre concrètement comment l’IA peut augmenter l’analyste sans ajouter de complexité à son quotidien. 30 min, concret. 👉 Lien d'inscription en commentaire

AI Threat Evolution 🚨 Au CERT, on ne théorise pas la menace : on la voit arriver. L'IA est passée côté attaquant : campagnes de phishing plus sophistiquées, automatisation de la reconnaissance, génération de code malveillant... Le vrai enjeu : distinguer les promesses des menaces réellement observées sur le terrain. Le 28 septembre, je fais le point sur l'évolution réelle de la menace IA. 30 min, avec le regard du CERT. 👉 Lien d'inscription en commentaire

📢 𝟭𝟱𝟬 𝗖𝘆𝗯𝗲𝗿𝘃𝗼𝗿𝗳ä𝗹𝗹𝗲. 𝟴 𝗣𝗿𝗶𝗼𝗿𝗶𝘁ä𝘁𝗲𝗻. 𝗘𝗶𝗻 𝗥𝗲𝗮𝗹𝗶𝘁ä𝘁𝘀𝗰𝗵𝗲𝗰𝗸 𝗳𝘂̈𝗿 𝗱𝗶𝗲 𝗖𝘆𝗯𝗲𝗿𝗮𝗯𝘄𝗲𝗵𝗿 𝟮𝟬𝟮𝟲. Zwischen offenen Patches, Identitätsrisiken, Cloud-Umgebungen und knappen Ressourcen entscheidet die richtige Priorisierung über die Wirksamkeit eurer Cyberabwehr. Wo sollte dein Unternehmen heute ansetzen? Knapp 150 Cybervorfälle, die unser CSIRT im 𝗲𝗿𝘀𝘁𝗲𝗻 𝗛𝗮𝗹𝗯𝗷𝗮𝗵𝗿 𝟮𝟬𝟮𝟲 bearbeitet hat, liefern ein klares Lagebild: ➡️ 34 % der Einfallsvektoren entfallen auf Phishing. ➡️ Bei 6 von 10 Ransomware-Fällen war fehlende MFA ein entscheidender Faktor. ➡️ Exponierte Lücken, Fehlkonfigurationen und Supply-Chain-Risiken bleiben relevant. ➡️ Public LLMs schaffen neue, schwer kontrollierbare Datenrisiken. Die entscheidende Frage für CISOs und IT-Verantwortliche deines Unternehmens lautet deshalb: 𝗪𝗶𝗲 𝗴𝘂𝘁 𝗽𝗮𝘀𝘀𝗲𝗻 𝗲𝘂𝗿𝗲 𝗦𝗶𝗰𝗵𝗲𝗿𝗵𝗲𝗶𝘁𝘀𝗽𝗿𝗶𝗼𝗿𝗶𝘁𝗮̈𝘁𝗲𝗻 (𝗻𝗼𝗰𝗵) 𝘇𝘂𝗿 𝗮𝗸𝘁𝘂𝗲𝗹𝗹𝗲𝗻 𝗔𝗻𝗴𝗿𝗶𝗳𝗳𝘀𝗽𝗿𝗮𝘅𝗶𝘀? 💡 Unsere Halbjahresanalyse 2026 liefert den Realitätscheck und 𝟴 𝗸𝗼𝗻𝗸𝗿𝗲𝘁𝗲 𝗠𝗮𝘀𝘀𝗻𝗮𝗵𝗺𝗲𝗻 für eure Cyber-Security-Strategie: https://lnkd.in/erxsbAaN

🔐 𝐈𝐝𝐞𝐧𝐭𝐢𝐭ä𝐭𝐬𝐬𝐢𝐜𝐡𝐞𝐫𝐡𝐞𝐢𝐭 𝐢𝐬𝐭 𝐞𝐢𝐧𝐞 𝐅𝐫𝐚𝐠𝐞 𝐝𝐞𝐫 𝐔𝐧𝐭𝐞𝐫𝐧𝐞𝐡𝐦𝐞𝐧𝐬𝐬𝐭𝐞𝐮𝐞𝐫𝐮𝐧𝐠. Denn kompromittierte Identitäten können weit über die IT hinaus Auswirkungen haben und im Ernstfall ganze Geschäftsprozesse gefährden. Die Auswertung von über 150 Cybervorfällen, die unser InfoGuard CSIRT im ersten Halbjahr bearbeitet hat, zeigt ein klares Bild: Phishing war mit 34 Prozent der häufigste Einfallsvektor, fehlende Multifaktor-Authentisierung (MFA) folgte mit 16 Prozent. Bei den untersuchten Ransomware-Vorfällen spielte fehlende MFA sogar in sechs von zehn Fällen eine entscheidende Rolle. Was mich daran besonders beschäftigt: Viele dieser Risiken sind grundsätzlich bekannt. Unternehmen führen MFA ein, definieren Richtlinien und sensibilisieren Mitarbeitende für Phishing. Für eine Geschäftsleitung stellt sich deshalb eine weiterführende Frage: Wirken diese Massnahmen tatsächlich dort, wo das Unternehmen besonders verwundbar ist? Gerade bei Identitäten ist das entscheidend: Werden vertrauenswürdige Konten oder Sitzungen übernommen, können Cyberkriminelle mit legitimen Berechtigungen auf geschäftskritische Systeme, Daten und Prozesse zugreifen. 𝐅ü𝐫 𝐦𝐢𝐜𝐡 𝐢𝐬𝐭 𝐝𝐞𝐬𝐡𝐚𝐥𝐛 𝐤𝐥𝐚𝐫: Es reicht nicht zu wissen, welche Schutzmassnahmen implementiert sind. Geschäftsleitungen müssen verstehen, welche Geschäftsrisiken damit tatsächlich reduziert werden – und welche bewusst oder unbewusst bestehen bleiben. 𝐅ü𝐧𝐟 𝐅𝐫𝐚𝐠𝐞𝐧 𝐡𝐚𝐥𝐭𝐞 𝐢𝐜𝐡 𝐝𝐚𝐛𝐞𝐢 𝐟ü𝐫 𝐳𝐞𝐧𝐭𝐫𝐚𝐥: ▶️ Welche geschäftskritischen Prozesse hängen von Identitäten ab, deren Schutz wir nicht ausreichend beurteilen können? ▶️ Wo akzeptieren wir Ausnahmen von unseren Sicherheitsstandards – und welches Geschäftsrisiko nehmen wir damit in Kauf? ▶️ Sind besonders kritische und privilegierte Identitäten angemessen geschützt? ▶️ Ist klar geregelt, wer für Identitätsrisiken verantwortlich ist und wer über Ausnahmen entscheidet? ▶️ Können wir die Wirksamkeit unserer Schutzmassnahmen belegen oder lediglich deren Implementierung? Die Antworten auf diese Fragen gehören aus meiner Sicht auf den Tisch der Geschäftsleitung. Denn wenn kritische Identitäten unzureichend geschützt sind, Ausnahmen nicht transparent gesteuert werden oder die Wirksamkeit zentraler Kontrollen unbekannt ist, wird aus einem technischen Security-Thema schnell ein Geschäftsrisiko. Cyberresilienz entsteht nicht dadurch, dass eine Kontrolle auf einer Checkliste abgehakt ist. Entscheidend ist, welches Risiko tatsächlich reduziert wurde und welches bewusst bestehen bleibt. Identitätssicherheit gehört deshalb aus meiner Sicht regelmässig auf die Management-Agenda. Sandro Bachmann, Principal Threat Intelligence Analyst bei InfoGuard AG, hat die Erkenntnisse aus den von uns untersuchten Cybervorfällen sowie die daraus abgeleiteten Prioritäten für die Cyberabwehr kompakt zusammengefasst. Den Link zur vollständigen Analyse findet ihr im Kommentar. 👇

Many security teams are about to hit a massive wall, and I am not sure they are realizing it. Finding vulnerabilities isn't the hard part anymore. For the past decade, the security industry optimized for a world where "more findings = winning": more scanners, more dashboards—an era defined by "single panes of glass." And then we wondered why exposure levels didn't go down. It just moved the bottleneck and created a slightly better-lit backlog. Meanwhile, software delivery is heading toward escape velocity (hello, AI-driven development)… while security headcount stays flat and many security teams unequipped to handle what's about to hit them. In that world, a monster backlog is not just inconvenient—it's fatal. The new game isn't about finding; it is about orchestrating security action with confidence on the few exposures that actually matter to the business, and driving them to verified closure. 24/7. That’s what CTEM is really about: a disciplined, continuous loop that turns chaotic signals into measurable exposure reduction. HackerOne's answer, our CTEM platform, is purpose-built for enterprises to quickly deploy and operationalize CTEM while rising far above the wall that the unprepared will smash into. It is a single system for continuous exposure reduction, combining agentic AI and human expert judgment to continuously discover, validate, prioritize, and remediate the real-world exposures that matter. (I’ll drop a link in the comments.) #CTEM #BugBounty #VulnerabilityManagement

Cybersecurity isn’t suffering from blind spots — it’s suffering from distractions. Finding vulnerabilities is easy. Knowing which ones truly matter is not. Every CISO I meet with is facing the same challenge: How do I separate real exposures from the noise before they turn into incidents? That’s exactly what we’ve built the next evolution of Hai, HackerOne’s agentic system of intelligent agents, to solve. By extending Hai into HackerOne Code and Agentic Pentest as a Service, we’re helping security teams move from a reactive cycle of detection to a continuous rhythm of validation, prioritization, and action. Because progress in security isn’t about finding more risks — it’s about knowing which ones matter. Over the next few weeks, our new series — Intelligence That Strengthens Every Layer of Defense — will explore how AI-driven exposure management is transforming how organizations prove what’s real, faster. Starting here: https://lnkd.in/dMTn83S8 When defenders can trust their intelligence, they can act with confidence. And that’s how security gets stronger — one validated signal at a time. #Cybersecurity #ExposureManagement #SecurityLeadership #HumanIngenuity #TrustByDesign #OffensiveSecurity

The AI patch wave is coming – is your estate ready? NCSC has warned organisations to prepare for increased patching pressure as AI accelerates vulnerability discovery and exploitation. For security and IT teams, the message is clear: Reactive patching will not be enough. Organisations need continuous, risk-aware patch management that helps them identify what matters, prioritise exposed systems, deploy updates faster, verify success and prove progress. This is where Heimdal®’s Patch & Asset Management module plays a critical role. We help organisations and MSPs automate patching across the estate, reduce manual effort, close exposure gaps faster and support compliance conversations around Cyber Essentials, CAF, NIS2, DORA, ISO 27001 and CIS Controls. But the bigger picture matters too. Patching is only one part of resilience. Heimdal connects patching with endpoint protection, DNS security, ransomware defence, privilege management, threat hunting and managed incident response through one unified platform. Because in the AI era, speed matters. Not just speed of detection. Speed of remediation! If this is something your team is thinking about, drop me a message. I’ll connect you with one of our top people for a personalised demo and a practical look at how Heimdal can help you stay ahead of the AI-driven vulnerability wave. Link to the NCSC blog in comments 👇 Morten Kjaersgaard | Cosmin Toader | Stefan Muresanu | Nabil Nistar #patchmanagement #vulnerabilitymanagement #cybersecurity #NCSC #MSP

Check out Mark Mager's inaugural blog post published 0.032 seconds after joining GreyNoise Intelligence. He wrote about how we're thinking about detecting everything, everywhere, all the time when the slope of vulnerabilities disclosed approaches a vertical line. https://lnkd.in/eiGyRJ-e

GreyNoise Intelligence is positioned to detect in-the-wild exploitation of the recent MikroTik "Mikrotrick" bug. A big-enough saturation of these profiles are up and running on our grid. All GreyNoise Swarm customers can deploy this profile right now as well. Exploitation has been publicly reported, but I do not believe mass, automated exploitation has begun yet. Last week CERT Polska shared their observation that six RouterOS vulnerabilities that are being chained in the wild. MikroTik patched on 2026-09-03 - 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. If you're on 7.x below 7.23.4, or 7.24.x below 7.24.2, or 6.x below 6.49.21, you're in range. A public POC has been posted. The attack chain is complex and wraps together the following CVEs: CVE-2026-67276 - SSH publickey forgery <---- this is the banger CVE-2026-86060 - SSH argument injection CVE-2026-67279 - unauthenticated command execution via rekey CVE-2026-67277 - btest pre-auth uninitialized buffer CVE-2026-67278 - X.509 signature forgery CVE-2026-67281 - WebFig /jsproxy unauthenticated root file read This is one of those attacks that's nightmarish to track from internet-watchers' perspectives. The network portion of the attack is over SSH-encrypted channels, post-keypair exchange, which means you can't use out-of-the-box network comms to detect the attack (unless you've got some kind of black magic to extract key material from running devices and decrypt communications 👀) Worse yet, the bugs target an embedded system, which presents lots of challenges WRT collecting host artifacts. Unfortunately we still can't run Microsoft Defender on Mikroktik routers, because neither Mikrotik routers, nor any routers, run Microsoft Windows. This is going to end up being one of those bugs where the majority of defenders will initially have to rely on the fingerprints of the known public POCs, which we will report as throughly as we are able to. Regardless, I'm pretty confident GreyNoise is in a good position to observe mass-exploitation of these vulnerabilities as soon as it starts.

Since a lot of people have been asking, here's how we got our first customer at Delve: — At the time, Karun and I were building an AI medical scribe in between classes at MIT. Along the way, we met the founders of Bland. They had just pivoted out of healthcare and had lots of insight. We kept in touch. As we continued building, we hit the point where we needed to get HIPAA compliant for our scribe. That’s when we went down the rabbit hole of compliance requirements for 6 weeks straight. By the end of it, we had gotten so many ideas for low hanging fruit automations that would've made the process less painful. So we pivoted to automate compliance itself. — Right around that time, the Bland founders reached out. They needed to go through HIPAA too. They had a deadline they needed to hit, so we essentially became consultants for them in that time window. We spun up cloud infrastructure, revised policies, and helped their entire team go through security training. A few months later, they came back to us because they needed SOC 2. This time we just went directly to their office. — We hit the whiteboards and mapped out their entire data flow: what tools touched which data, where sensitive information flowed, and what technical architecture looked like. Then we made a plan of attack to divide and conquer the work. That day turned into a compliance super-day. By the end of it, they were done with major compliance requirements and had made significant security improvements across the board. (Plus, we had gotten a much better understanding of the process and knew even better how to streamline the process). Later, we managed the entire SOC 2 audit process for them from start to finish. We stayed in their Slack channel answering questions with 5min response time throughout the audit. — In that week alone, Bland unlocked $500k ARR with their SOC 2 report. To date, they've powered 50M+ phone calls and are used daily by 100+ enterprises. Meanwhile at Delve, we've scaled a lot of what we did for Bland. Now, every Delve customer gets a 1:1 Slack channel, end-to-end audit support, and a TurboTax-like platform that lays out compliance requirements very clearly. After Bland, we continued to do "compliance Collison installations" for many other customers and further automated everything that we did manually behind the scenes. — So to everyone who's been asking: your first customer doesn't come from cold outreach or paid ads. It comes from solving a problem you understand for someone you already know. Don't be afraid to consult or get your hands dirty. Those learnings help you build an even better experience and product compared to alternative solutions.

Last month, Bland completed a 24-hour in-person audit for a F100 enterprise with the help of Delve (spoiler: they passed with flying colors). Here's the story: Bland is an AI voice provider with over 100 enterprise customers that’s powered 50M phone calls to date. After a 9-month sales process with a F100 (which involved many security questionnaires), they made it to one of the final stages: an in-person audit. That meant an auditor would come to their office and spend 24 hours reviewing compliance policies, automated infrastructure tests, and past audit reports. — After a long 2 days and even more review, Bland ended up passing with flying colors. They scored the highest grade possible on the security review. Even the division’s managing director was “shocked at how well [they] did.” — At Delve, we know that compliance isn’t just about completing a checklist of to-dos or getting a PDF report. It’s about closing larger deals, reducing risks to your company, and scaling faster. For us, that means going the extra mile to help companies build strong security that won’t just get them to pass an audit, but also meet enterprise expectations. — So happy for Bland. They’re just 1 example of all the incredible things Delve customers accomplish.

GDPR compliance comes down to knowing your data. What data do you collect and have a lawful basis for processing it? Data compliance should solve business problems, not create them. A startup that knows its data flows is better positioned than an enterprise with perfect documentation but no clear processes. Some companies have privacy policies but no idea what triggered Article 27 requirements - the obligation to appoint a local EU representative when you're based outside the EU. That’s why you should map your data flows first. Document your lawful basis second. Build from there. GDPR compliance is operational work that keeps you in business. For practical guidance on each of these steps: gdprlocal.com

Do you know what a DPO does? It's a structured function that covers every layer of your company's data processing. Here's what a DPO does in practice: Advice & Guidance → Informs and advises management and staff on their obligations under the GDPR. Monitoring & Audits → Does internal audits and compliance checks, and reviews data protection policies, procedures, and documentation. Liaison & Contact Point → Acts as the primary contact point for Supervisory Authority and DSARs. Breach Management → Advises and assists the Controller in the event of a Personal Data Breach, including notifications. Training & Awareness → Advises on and provides a data protection awareness training plan. That's a lot of distinct functions. Each one has its own process, its own documentation, its own challenges. Understanding the full scope of what a DPO manages is the first step to knowing whether a company has the right coverage. See the full framework → dpo.gdprlocal.com

Code signing is an increasingly sought-after addition to existing cryptographic services and Public Key Infrastructure (PKI) offerings, with bolstered demand driven by fears surrounding supply chain attacks and AI security. Three buckets of use cases are of particular note as the code signing market continues to evolve: 1) AI use cases: Provenance concerns alongside IP and proprietary data protection interests are currently concentrating demand around model signing, however the proliferation of AI agents into enterprise environments is contributing to growing demand for workflow signing despite runtime context introducing some obstacles for deployment here. The status and projected trajectory of emergent AI-orientated use cases is a progressively important development to watch in this space. 2) IoT use cases: Despite the increasingly widespread nature of code signing applications such as embedded device and firmware signing, device heterogeneity and the resultant interoperability challenges, long device lifecycles, and limited compute capacity or memory all continue to complicate deployment. 3) DevOps use cases: Code signing is also an established part of DevOps and the CI/CD pipeline, however, macro challenges impacting the broader PKI market are beginning to impact DevOps signing processes. Increasing supply chain attacks, demands for quantum migration, and costs are all points of friction here. Our thoughts on the opportunities and challenges presented by the code signing market as well as some of the key vendors operating in this space such as Garantir Cybersecurity, Encryption Consulting LLC, SEALSQ, Entrust, Keyfactor, HID, AppViewX, and DigiCert are covered in our recent reports, linked in the comments below.

You can't really prepare to turn 40. It just happens. It happened to me last week. Incidents can't be prepared for either...I've had my share & the rudely fail to ever warn you before they hit! In a previous role, we took resilience testing seriously. Twice a year we'd break down the environment and actually stand it back up again, from infrastructure through to applications and data. We recorded it. Documented everything. We actually proved we could meet our RTOs and RPOs. I'd argue this was better than what most organisations were doing. But we'd spend the preceding 30 days getting ready. Practising recovery. Finding issues. Fixing things. Updating documentation. Trying again. And that's the bit I've thought about a lot since...We proved we could recover after preparing to recover. Real incidents don't work like that. You don't get 30 days to make sure everything works before the ransomware hits. Nobody freezes your environment while you prepare. And something you successfully recovered six months ago may have changed hundreds of times since. That's why I've changed how I think about resilience. I'm less interested in whether you passed your last DR test. I want to know whether you could recover your Minimum Viable Business today, tomorrow, next week... No rehearsal. No warning. Just the environment as it exists right now. That means understanding recovery continuously as code, infrastructure and dependencies change, rather than proving it at two carefully prepared points in the year. That's a big part of what we're focused on at Gambit. Continuously proving whether the systems your business actually depends on are recoverable. Turning 40 was inevitable (& surprisingly pleasant) Realizing a 4 hour RTO actually takes 30+ hours (& is ver unpleasant) doesn't have to be inevitable! Book a resilience assessment: hhttps://lnkd.in/eE8JJy-W

Cool snippet from the previous "Railway case" where we saw threat actors spamming Device Code phishing emails -- Flare was what came in clutch to help attribute that activity to the EvilTokens group. All the chitchat they had in Telegram was already indexed and immediately searchable 😎 That's one of Flare's sweet superpowers... ingesting entire ecosystems for threat intelligence, and they've got billions of messages from hundreds of thousands of channels. Pretty sure they're at like 15 million new data points collected every day (😅) from inside the communities where actual attacks are schemed up. All that insight turns into something that's really actionable: you can know when cybercriminals are threatening your own organization and industry. They call that "threat exposure management" 😜 You can search for billions of leaked credentials and hacker chatter with an easy free trial -- link below in the comments 👇 (ps, this is a sponsored post #ad)

🚨Eek! Someone's been reading my diary! 😮📖 As a GRC lover whose vibes are synthwave all day, I am over the top excited about Flare Academy's SummerSlam event July 29! 8 threat intel researchers. One virtual court. Zero red cards. AND I’M THE REF! 🤩 ---------------- CTI Summer SLAM, a live session where 8 researchers get real about what they're tracking on the dark web, in cybercrime, and across the wider threat landscape. 💡 Here's what's on the card: Where the threat landscape stands right now, straight from the people living in it every day. ❌ Not a slide deck ❌ Not a quarterly report ✅ The real read, plus the heated conversations researchers are actually having about what comes next. ---------------- 🔑 The roster is ABSOLUTELY stacked Andréanne Bergeron, PhD, Tammy H. Olivier Bilodeau, Adrian Cheek, Estelle Ruellan, Chris D., Oleg Lypko, and Assaf Morag. Eight researchers who spend their days in places most people never see, plus a very special guest. ---------------- 🤝 My job for the day: keep six segments moving, keep it fun, no fouls called, and let the researchers cook 🧑🍳 This event blends hard-hitting threat intel with a fun environment to keep it flowing. 🗣️ Threat intel voices you can actually trust, live, taking your questions. ---------------- 📢 Claim your bleacher seat! Doors are conceptual, showtime is 12pm EST. 👇 Register here: https://lnkd.in/gE4n8-dp

I had an amazing conversation with Tim R. about what it's like on the front lines of a ransomeware negotiation. From ransom demands and attacker tactics to the emotional toll on hospital leaders, he shares the reality of the situation and the best way to protect patient safety when every second counts. Don't miss episode 15 of Cyber Survivor here: https://lnkd.in/dCd9YHY8

Check out my first Cyber Survivor live from our new studio! We kicked things off in person with Scott E. Augenbaum, former FBI agent, author, and all-around cybersecurity truth teller. We dug into how cybersecurity has evolved and why your mindset might be the most important tool in preventing a cyber attack. Watch here: https://lnkd.in/gGpuym9d

Compliance is often seen as a constraint. It shouldn’t be. Great to be partnering with VINCI Construction & Axians Industrial Applications & Services. When it comes to AQP, complying with the standard does more than ticking a regulatory box. It helps you prevent fraud and improve operational efficiency at the same time. Check this short Evidency video to find out

"AI pentesting can't find business logic vulnerabilities." Hackian just found two in n8n and SonarQube. No scanner would catch these. 80%+ of pentesters would not catch these. Because they're not signature-based vulnerabilities. And they're not the typical checklist vulnerabilities. They're business design flaws. And complex ones in complex targets. n8n example: Hackian exploited how the workflow automation was architected, bypassing intended access controls through legitimate-looking API calls. SonarQube example: Hackian accessed projects it wasn't supposed to by understanding and exploiting the permission model itself, not by breaking authentication. These are the "ghosts" everyone says AI can't find. Here's the difference: Traditional tools look for patterns. Known signatures. Predictable exploit chains. Hackian doesn't scan. It reasons. → It explores applications like a human hacker would → It tests assumptions about how things should work → It experiments with edge cases and logical inconsistencies → It validates real exploitation, not theoretical risk This is Agentic AI pentesting. Not a scanner with better marketing. To everyone who says AI can't find business logic vulnerabilities. Here you go. Two real exploits. And if Hackian can find them, criminals can too. Full technical breakdown: https://lnkd.in/eZENHg82 Still think AI pentesting is just hype? Try Ethiack and you will see

European CISOs, stop pretending it's about quality "We don't buy European cyber because the quality isn't there." How convenient. In many categories, European vendors are: - Cheaper - More responsive - More flexible - Closer to your regulatory reality - More aligned with NIS2, DORA, EU frameworks - With a similar or superior product quality Yet they still lose. Why? Because: - You default to American/Israeli brands - You trust marketing more than results - You outsource thinking to analysts - You confuse market share with technical superiority And in cyber, that's dangerous. When your entire security stack is non-European, you are not sovereign. And neither is your country. You are dependent. Vulnerable. Exposed. Dependency is not neutral. It affects: - Pricing power - Strategic leverage - Data exposure - Political pressure - Long-term innovation capacity This is not anti-American or Israeli. This is pro-European responsibility. If you are an European CISO and you never consider European vendors, you're part of the problem. Digital sovereignty will not be solved by politicians and bureaucrats. It will be solved by procurement decisions. It will be solved by you. Do you actually benchmark European tech? Or do you just assume it's inferior? Be honest. *Here is a pic of me talking at ENISA, so that my point stands stronger.

Most sovereignty programs start with the largest dependency: cloud infrastructure, M365, enterprise platforms. Highly critical. Also the hardest to replace. These programs spend years planning the migration least likely to finish, while controls that could move this year sit untouched. An alternative framework uses two axes: 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹𝗶𝘁𝘆 — what happens if you lose access, visibility or control? 𝗔𝘁𝘁𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 — does a credible sovereign option exist today, and what does switching cost? 𝘕𝘦𝘵𝘸𝘰𝘳𝘬 𝘋𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯 & 𝘙𝘦𝘴𝘱𝘰𝘯𝘴𝘦 (𝘕𝘋𝘙) and 𝘜𝘴𝘦𝘳 𝘢𝘯𝘥 𝘌𝘯𝘵𝘪𝘵𝘺 𝘉𝘦𝘩𝘢𝘷𝘪𝘰𝘳 𝘈𝘯𝘢𝘭𝘺𝘵𝘪𝘤𝘴 (𝘜𝘌𝘉𝘈) score high on both. Critical, because they detect intrusion, lateral movement and exfiltration. Attainable, because they can be architected to run on customer-controlled or EU-sovereign infrastructure with no outbound dependency on a foreign cloud. The first move should follow that combination — not the size of the platform. More on Exeon’s approach: https://lnkd.in/e9X_Xnuq

I often hear from organisations that they assume they are secure simply because they have not experienced a known cyber incident. In reality, once we begin onboarding and conducting proactive threat hunting and continuous monitoring, it is common to uncover indicators of attacker persistence or potential insider activity. Having the right security tools and baseline configurations in place does not guarantee protection. Without continuous monitoring, tailored detection logic, and proactive investigation, malicious activity often goes unnoticed. To help organisations evaluate SOC providers, we have created a checklist designed to prompt the right questions, such as: • Do they provide continuous 24/7 monitoring and response across your environment? • Can they deliver custom integrations to support unique and complex environments? • How frequently are detections and rules tuned to your specific environment? • Do they proactively hunt for threats, or do they rely solely on automated alerts? Download our SOC provider checklist and use it to benchmark potential providers: https://lnkd.in/dVDwRt2B #SOC #CyberSecurity #SOCaaS #MDRsolutions #Security #Infosec #Cyber #SecurityOperations #ManagedSecurity #DefensiveSecurity