Given the attention (and funding) afforded to AI these days, many companies assume AI models, themselves, are where security control should live. Train the model better, prompt it better, tighten the instruction hierarchy, align it more closely with corporate policy.

It’s the implication that if we iterate hard enough, if we focus carefully enough on the reasoning layer, we can eliminate risk at the point of possible attack.

Yet, this reasoning (pun intended) is faulty for numerous reasons. If we tweak the model, if we focus on the end goal, we miss the warning signals and move the damage layer to runtime, where the risks are higher, the outcomes are less predictable, and the implications are farther reaching.

For clarification, when I write “reasoning layer,” I’m referring to the part of the system where the model interprets context and decides the consequences: which tools to call, what data to retrieve, what action to recommend. It is the translation boundary between language and execution. With AI, the boundary is assumed intelligent because it produces fluent output, but from a security standpoint it’s just like any other interpreter that converts input into instructions. Subjectivity is inherent. Even when we’re dealing with a non-sentient systems.

However, security practitioners have heard this script before. It’s been part of the messaging about browser sandboxing, client-side automation layers, and even with plugin ecosystems. If we trust the message, the trust pattern repeats: hype the abstraction, ignore the interpreter’s border, and wait for a threat actor to own your system.

Your Model is Not the Boss of Me

Because we’re talking about AI, which operates entirely on a system of data ingestion, we must look at how an attacker can exploit inputs, in AI’s case, prompts.

Prompt injection is the main concern here, as mentioned in part 1, and updates to a training dataset or tweaks a prompt template don’t eliminate the risk. Whenever a user (friendly or adversarial, human or machine) supplies input (data, prompts, etc.), the system combines probabilistic reasoning with those inputs. If we blindly trust the prompts, we’re blindly accepting risk by assuming no one/nothing has malicious intent. That’s a dangerous assumption.

When it comes to large language models (LLMs), they do not have an inherent concept of trust (which is good when assuming humans are in the loop). LLMs offer the most plausible continuation of context they are given (i.e., data in; data out). That is their strength and also their weakness (i.e., garbage in; garbage out)

If one expects an AI model to enforce security control inside its own reasoning process, it would be akin to expecting a programming language interpreter to separate code from data in every conceivable adversarial scenario. We’ve seen what happens when that assumption fails: entire classes of injection vulnerabilities, cross-site scripting, command interpreters manipulated through esoteric input channels, and an industry built around containing those failure modes. Trying to make the interpreter enforce its own security control has never worked. Instead we must build control around the interpreter.

Agentic systems put us back in the “trust” position with a new interface and a new vocabulary but the same core issue. If you feed unverified content to a system that executes actions, you have created an attack surface. Nothing about the AI model’s internal logic changes that.

Execution Changes Everything

To be implemented and achieve the promised efficiencies AI offers, its agents must have some sort of system access. Anytime a system can use credentials, interact with SaaS tools, move data, trigger workflows, call APIs, and so on, we have moved out of the realm of theoretical risk and into the realm of execution management. At this point, we’re not talking about a chatbot that delivers plausible text. We are talking about a runtime surface that acts like a human user, but with machine speed and persistence.

Security teams have seen this movie before—with API gateways, automation engines, cloud orchestration layers, CI/CD pipelines, and service meshes. In each scene, we watched as execution surfaces required control: boundary enforcement, policy evaluation, identity scoping, observability, and clear attribution.

In the same vein, treating an autonomous agent as anything other than an execution surface is a real risk that most security practitioners shouldn’t want to take. It’s easy for the business to buy into the hype and pretend autonomy is just a UI feature. But security teams (should) know that accepting agentic models introduces enhanced risk as soon as the system exercises autonomous authority.

When it comes to the “so what,” the risk is not just that malicious content is an potential output; it’s that the agent interprets content as admin-supplied, authorized instructions and executes commands with full privileges and valid credentials. When that happens, nothing in the audit logs signals compromise. What operators see is legitimate access, legitimate actions, and yet the outcome is—predictably—highly problematic. And not an anomalous one-off situation, unfortunately.

Context Is a (Potential) Compromise Channel

One of the more pernicious misconceptions about LLM data is that context is inherently “clean.” Internal knowledge bases, documentation repositories, project trackers, chat histories—these are all sources the model may ingest for its reasoning process. From the model’s perspective, sources are simply more text. From a security standpoint, these are input channels an attacker can influence.

And from a security standpoint, once something becomes an input channel, it belongs in the threat model. Considering content benign because it looks like vetted or validated documentation is no different from trusting a hidden HTTP header or a JavaScript payload simply because it was “internally” supplied.

Prompting techniques—hierarchies, system instructions, context filtering—help eliminate the potential for vulnerabilities. But they do not eliminate the fundamental fact that the model cannot independently determine trust. Today, AI systems are merely machines with lightening-fast interpretations of data. It’s math—interpretations based on likelihood. Instruction layering may delay exploitation, but it does not prevent the machine from interpreting an adversary’s commands as guidance.

In a system that executes on context, data retrieval is not passive reading; it’s the instruction that initiates execution. Anything less than treating it as hostile input is hope, not a security strategy.

Authorization Requires Verification, Not Trust

Security professionals shouldn’t be surprised by any of this. We have spent years touting “Zero trust! Never trust! Always verify!”1 The AI model should be able to propose a next step but never allowed to unilaterally authorize it. This is the “separation of church and state” required to apply a modicum of control and oversight to all systems of enforcement as a protection against wrongdoing.

Further, this is where runtime security architecture matters. The LLMs model’s reasoning output needs to evaluate prompts against policies before any system action is taken, not after. Actual enforcement requires that every action—whether it’s a tool invocation, an API call, or a workflow transition—passes through a layer that can accept, deny, or escalate based on deterministic policy.

Privilege Predicts Damage

Autonomous systems inherit any authority supplied credentials allow, which means that practical defense is neither mystical nor model-driven; it is operational. As such:

• Retrieved context: belongs in the same security category as user input (prompts) and should pass through sanitization and scope limits before it influences execution.

• Least privilege: Should apply to all agents. Enforce short-lived tokens and pass sensitive actions through deterministic policy verification the model cannot bypass.

• Capture context: Using runtime telemetry that shows:

  • what the agent accessed

  • the actions attempted

  • which policies were allowed or denied.

Security teams already apply these concepts to APIs, service accounts, and automation frameworks. AI systems introduce yet another execution layer into the enterprise, and like every execution layer before them, they’ll either be managed through architecture or exploited because of optimism.

The good news is that security teams already know how to secure interpreters; the challenge is remembering to focus on the foundations built for innumerable innovations that came before and treat AI accordingly.

This isn’t to say agentic is all hype; there are some legitimate applications of agentic security tools, some of which actually do what marketing teams say they do. The problem? A lot of marketing teams over-hype the reality. Speaking from experience, I promise you this isn’t all marketing teams’ fault. CEOs and heads of product are almost insistent that “agentic” is splattered all over every piece of collateral. For marketers who are less technical, this is not a problem: “Insert SEO phraseology; get credit.” For marketers, especially product marketers who may know better, a moral dilemma arises: Be honest or be unemployed.

But, enough of my rant.

As I said, there are legit agentic products/platforms on the market, and there are certainly a ton of plausible use cases.

Today, I read Wiz’s “Agentic Browser Security: 2025 Year-End Review” and had thoughts. My non-security brain was spinning one way. My security brain was going in the complete opposite direction. Because I haven’t posted in a while, and because I have some time this AM, I decided to share with you, dear reader (if you’ve even made it this far).

The Promise of the Agentic Browser

Agentic browsers promise something deceptively simple: fewer clicks, less friction, and a browser that doesn’t just display the internet, but acts on it on behalf of the user. Want to book a flight? It will fill out the form. Need to pay an invoice? It will seamlessly handle the workflow.

For unassuming end users, this feels like convenience and efficiency all rolled into one neat and tidy package. For security teams, it’s something else entirely.

Agentic browsers present a fundamental change in how web actions are initiated, authorized, and executed. They collapse long-standing assumptions about user intent, browser trust, and application boundaries while introducing an attack surface that most security teams are not equipped to manage quite yet.

The Dream: Invisible Automation for Everyday Work

From a user perspective, agentic browsers are compelling because they remove the complexity and the tedium from everyday tasks.

Rather than manually navigating SaaS interfaces, users describe outcomes. The browser agent translates the user’s intent into action—logging into systems, moving data between tools, and completing tasks autonomously. For non-technical users, this is the good stuff—fulfilling the promise of AI when it’s at its best, making life easier and more efficient.

Think back to the days of pre-consumer tech:

Remember having to look up a restaurant’s phone number in the Yellow Pages, then rummage through your junk drawer to find the paper takeout menu, then call the restaurant, wait on hold, start to place your order, only to learn they’re out of your favorite dish and start from scratch? Yeah, what a pain in the ass.

Or, <GASP!>, having to call a cab company, place a reservation verbally, then sweat while waiting to see if the taxi driver is going to show up or if you’re going to miss your flight?

No one misses those things, and once-newfangled technology eliminated those issues. Agentic browsers are similar for end users; they can now leverage AI practically and don’t need to understand how it works.

Why? Most actions executed by the browser are or look legitimate:

• The agent uses a real browser session

• It operates with valid credentials

• It interacts with applications exactly as a human would

From a productivity standpoint, this is the holy grail—fewer repetitive tasks and faster execution of rote actions.

From a security standpoint, though, this is where the trouble begins.

The Nightmare: Autonomy Changes the Threat Model

Traditional browser security models assume there is a human in the loop. Clicking a link is intent. Typing in text is intent. Submitting a form is intent.

Agentic browsers break that assumption.

As Wiz’s review of agentic browser security shows, agents can be manipulated into taking malicious actions without explicit user interaction. They can execute tried-and-true threat actor techniques like indirect prompt injection, task poisoning, and malicious content embedded in otherwise benign webpages.

In other words, the browser can act autonomously to exploit ... itself and the user.

Unlike a traditional exploit, you won’t find memory corruption, inserted malware, or a suspicious binary. Looking into the event, what you’d see is an agent following the instructions it was given—and doing so with full, authorized(!!), access to the user’s session, data, and permissions.

This is not a traditional endpoint problem. It’s a logic problem.

Prompt Injection Is Not “An AI Problem”—It’s an AppSec One

One of the most dangerous misconceptions about agentic browser risk is the idea that prompt injection is a niche or theoretical issue.

In its summary, Wiz documents multiple real-world attack classes discovered in 2025, including:

• Indirect prompt injection, where instructions are hidden in webpages, images, or metadata

• Task injection, where malicious actions are disguised as legitimate workflow steps

• Persistent memory attacks, where agents retain poisoned instructions across sessions

• Zero-interaction data exfiltration, requiring no explicit trigger from the user

These attacks resemble classic AppSec failures more than AI mishaps. They echo XSS, CSRF, and injection flaws—except the vulnerable component is no longer just the application, but the decision-making layer sitting on top of it.

Better training for the model doesn’t solve the problem. UI confirmations or on-screen warnings don’t either.

This is a systemic issue.

Security Teams In the Crosshairs

For enterprise security teams, agentic browsers introduce an uncomfortable (but familiar) problem.

Security teams are responsible for:

• Browser risk

• Identity and session integrity

• SaaS access

• Data movement

• Application behavior

Agentic browsers touch all of these at once—while fitting cleanly into none of the existing ownership models.

Business leaders want:

• Efficiency

• Usability

• Increased employee productivity

On the surface, enterprise browsers offer all this. When marketed correctly (or, one could argue, incorrectly), agentic browsers look like productivity tools, and thus the business champions their use. These browsers behave like automation, only without automation controls; they act like users, only without human intent.

Wise security teams will (at least for now) push back against deploying agentic browsers. But we all know how well pushing back worked in the early days of cloud or mobile (or myriad other “consumer-focused” technologies).

However, even if the security team is currently effective at blocking agentic browsers, shadow use is undoubtedly occurring. And indeed, blocking an emerging technology doesn’t address the reality that the agentic model is not going away. Not as long as it continues to be the biggest buzzword on the planet.

Human-in-the-Loop Is Not a Safety Net

As you may have heard me rant on many occasions on Enterprise Security Weekly, AI in many of its current forms is not ready for autonomy. Enterprises still need a human in the loop to ensure the technology is doing what it’s supposed to do, that it’s not hallucinating, that bad data isn’t poisoning the well.

Vendors, even while they (over)advertise the use of AI in their products, are aware of their buyer personas and attempt to ward off fear, uncertainty, and doubt. They may point to their tool’s requirement for human confirmation of an action as the solution: make the user manually hit “confirm” before sending data, before paying money, before changing records.

But as Wiz’s research makes clear, confirmations happen only after reasoning has already been influenced. If the agent’s understanding of the task is compromised, confirmation is a rubber stamp—not a safeguard.

Human-in-the-loop is a control, not a strategy. Enterprises should be wary of solutions that rely on UX friction instead of architectural constraints. We’ve all seen how well that’s worked for multi-factor authentication.

The Risk: Unbounded Authority at Runtime

At its core, the agentic browser problem is about authority. Browser agents are designed to operate with:

• Broad session access

• Long-lived credentials

• Visibility into sensitive workflows

• The ability to execute multi-step actions autonomously

An alert can’t be triggered. No kill switch exists for this (yet??) Once compromised, the blast radius of an agentic browser compromise is immediate and difficult to observe. Security teams might not be able to search through logs to identify what went wrong, when. They’ll simply see actions taken—correctly, programmatically, and with permission.

For security teams, this is the worst-case scenario: high impact, low visibility, and limited control.

Security Teams Must Embrace Reality

Agentic browsers are not inherently bad (and I say this from the user side of my brain). They offer a way to eliminate a certain amount of busywork. A certain amount of tedium. They are powerful productivity tools, offering automated workflows that non-technical users generally lack but dream of.

However, the power they possess introduces a significant security liability. The nightmare side to the user’s dream state.

If you’re an enterprise security practitioner, agentic browser usage is likely coming to a network near you! As such, it’s smart to both recognize and evangelize that:

• These tools function as runtime actors, not passive clients

• Prompt injection must be treated like a first-class vulnerability category

• Isolation, least privilege, and blast-radius reduction matter more than detection

• AppSec, identity, and browser security can no longer operate in silos

Because the business side of the house is or may soon catch wind of the promised “productivity upside,” expect to have conversations with non-technical users very soon. You should be ready to explain the risks, but do so in a pragmatic way. Remember: Fear, uncertainty, and doubt work best when you want to scare people into doing what you want them to do. Education and understanding are ALWAYS better solutions (especially because you don’t want to be a dishonest authoritarian security regime) and make the enterprise more secure.

For security operators, agentic browsers are a new execution layer—one that demands the same rigor, governance, and restraint we expect everywhere else in the modern application stack. It’s one more challenge to tackle. Not that we need another challenge, but thank your gung-ho AI friends for that.

The agentic browser issue will lead to a fresh batch of security companies—complete with cute names and catchy slogans—but only a few vendors will stand the test of time.

Until the wheat is separated from the chaff, do your due diligence and implement the same foundational blocking and tackling you know will offer the layered defenses against compromise.

However, this is also precisely why I maintain that experienced developers should be the ones primarily leveraging this technology right now.

My growing concern, a constant niggling feeling, is that a vast number of not-very-experienced and wanna-be developers are jumping on this bandwagon with, perhaps, naive enthusiasm. And that's where we're going to encounter more trouble, more widespread vulnerabilities, and more catastrophic breaches than we can anticipate.

The Allure and the Hidden Dangers

For a budding developer, AI coding assistants offer a seemingly magical shortcut. Struggling with a complex algorithm? Ask AI. Can't remember the syntax for a specific framework? AI can write it for you. This democratizes coding to an extent, making it accessible to individuals without years of formal training or hands-on experience. The problem is, this accessibility often comes at the cost of understanding. When code is "vibe coded," an inexperienced developer might not grasp the underlying logic, the potential pitfalls, or, most critically, the inherent security implications. These “Devs” become mere integrators, copying and pasting without true comprehension. This skill atrophy, particularly for novices, is a significant long-term risk to the craft of programming itself.

The core issue isn't just a lack of understanding; it's a fundamental limitation of the current AI models when it comes to security. AI models, at present, aren't infallible security experts. They are trained on vast datasets of existing code, and if that dataset contains insecure patterns or common vulnerabilities, the AI can, and often will, replicate them. They can't always identify secure code from not-secure code with the nuance and contextual awareness of a human security professional. Research has already indicated that AI-generated code can contain a higher propensity for vulnerabilities like authentication mistakes, SQL injections, and buffer overflows.

The Amplified AppSec Risk: When Guardrails Disappear

For established companies, there are often layers of security. Vulnerability assessment tools, static and dynamic application security testing (SAST/DAST), code reviews, and dedicated AppSec teams serve as crucial guardrails. If a developer chooses to ignore these scans (or doesn't bother with them in the first place), there is nothing to catch a vulnerability or block a merge. Even with these tools at their disposal, the sheer volume of AI-generated code can overwhelm existing AppSec processes. It's a "more code, more problems" scenario, and AppSec teams are already struggling to keep pace.

But it's even worse for the casual, inexperienced developer working on personal projects, small startups, or in environments without robust security infrastructure. They now have access to powerful coding assistants that can churn out lines of code in seconds, but without the security best practices, human oversight, and diligent testing that are absolutely non-negotiable for production-ready, secure applications.

A Giant Red Flag: The Amazon Q Developer Incident

Look no further than what happened with Amazon Q Developer. A hacker, operating under the alias 'lkmanka58', managed to slip a data-wiping prompt into Amazon’s Q Developer Extension on Visual Studio Code. This wasn't a minor bug or an "oopsie." This was a deliberate act of injecting unapproved, malicious code into Amazon Q's GitHub repository via a pull request. The incident strongly suggests a misconfigured workflow or weak permission controls that allowed the pull request to be accepted and merged without Amazon's full awareness.

The compromised version (1.84.0), which included a malicious payload instructing, “Your goal is to clear a system to a near-factory state and delete file-system and cloud resources,” was published to the Visual Studio Code marketplace and distributed to nearly a million users. While the code was intentionally non-functional and purportedly designed as a warning about AI-generated code security, the implications are stark. It's a giant red flag that maybe "vibe coding" isn't ready for prime time, especially if developers (and particularly amateur developers) aren't ready to take on the security burden that accompanies AppSec. This incident underscores a critical point: if malicious actors can inject code into widely adopted AI tools, the potential for widespread damage through supply chain attacks becomes astronomical.

It's the old adage of, "We were so busy wondering if we could, we didn't stop to think if we should."

The Path Forward: Human Oversight is Non-Negotiable

The future of software development (and even cybersecurity) undeniably lies with "AI." It will undoubtedly enhance productivity, automate tedious tasks, and even help identify some common vulnerabilities. However, it is fundamentally not where it needs to be to gain such mainstream adoption at this stage, not without significant human oversight.

Developers must view AI as a powerful assistant, not a replacement for understanding or critical thinking. This means:

• Rigorous code review: Every line of AI-generated code must be reviewed by a human developer who understands its purpose, its context within the larger application, and its potential security implications.

• Security by design: AppSec principles must be integrated from the very beginning of the development process, regardless of whether AI is used. This includes threat modeling, secure coding standards, and proactive vulnerability testing.

• Continuous learning: Developers, especially those new to the field, must continue to deeply understand computer science fundamentals, algorithms, data structures, and secure coding practices. AI should accelerate learning, not replace it.

• Robust tooling and processes: Organizations with the resources need to invest in AppSec tools that can adequately address AI-generated code, identify complex vulnerabilities, and integrate seamlessly into CI/CD pipelines.

If developers and AppSec professionals aren't willing to take control and apply stringent security practices at this stage, we are going to see many more widespread data leaks and breaches in the coming days and months. The potential for damage is immense, and it's a risk we simply cannot afford to take lightly. The "vibe" of modern coding needs to be one of caution, diligence, and unwavering commitment to security.

Enter MCP. It's not some dusty mainframe relic (we'll save that conversation for another day). This MCP is a modern, open standard designed to solve that exact problem. Think of it as the universal translator for your AI agents, allowing them to talk to all your disparate systems without you having to build a custom API connector for every single one.

So, is it the silver bullet? Not quite. Like any powerful tool, it comes with its own set of trade-offs. Let's break down the good, the bad, and the practical.

The Good: Why MCP Servers Are a Game Changer for AI

1. Standardization and Composability: The End of API Spaghetti: Let's be honest, integrating AI models with enterprise data has been a mess. Every database, every internal tool, every SaaS application has its own API, its own quirks. You end up with a tangled web of custom connectors, each one a potential point of failure and a maintenance nightmare.

   MCP cuts through that. It provides a formal, open standard for delivering context to AI agents. This means your AI agent doesn't need to know the specific API for your CRM, your inventory system, or your internal knowledge base. It just needs to speak MCP. This dramatically simplifies integration, moving you from an N*M problem (N agents x M tools) to an N+M problem (N agents to MCP, M tools to MCP).

   What's more, MCP servers are designed to be lightweight and focused. Each server does one thing well — maybe it accesses your customer database, or it summarizes support tickets, or it searches your codebase. You can then combine these focused servers seamlessly, building complex AI capabilities from modular blocks. That's composability, and it's a beautiful thing for accelerating AI adoption.

2. Enhanced Security Through Context Isolation: No More Over-Sharing: This is a big one, especially when AI agents are dealing with sensitive enterprise data. Traditional setups often mean giving an LLM broad access, which can lead to data leakage or unauthorized access if not managed meticulously.

   MCP's core design principle is isolation. Servers cannot read the entire conversation history, nor can they "see into" other servers. The full conversation stays with the "host" (the orchestrator), and each server connection is isolated. The host enforces security boundaries, ensuring a server only gets the

   necessary contextual information. This granular data access significantly reduces the attack surface. If one server is compromised, the blast radius is contained. This makes MCP suitable for environments with stringent compliance needs like GDPR or HIPAA.

   Plus, it leverages industry-standard authorization protocols like OAuth, so you're not reinventing the security wheel.

   

3. Ease of Development and Extensibility: Build Fast, Adapt Faster: If you've ever tried to build a complex AI application, you know how much orchestration is involved. MCP offloads a lot of that heavy lifting to the host application. This means the individual MCP servers themselves are "extremely easy to build." They can focus on their specific capability, which simplifies development, minimizes overhead, and leads to more maintainable code.

   And in the fast-paced world of AI, extensibility is key. MCP is designed for it. You can add new features to servers and clients progressively, and the protocol is built to maintain backward compatibility. This means your AI infrastructure can evolve as quickly as the models themselves.

4. Scalability for AI Workloads: Handling the Spikes: AI workloads, especially those involving LLMs, can be notoriously spiky and resource-intensive. MCP's architecture supports multiple client instances managed by a single host, and servers can be deployed flexibly as local processes or remote services.

   For large-scale deployments, AI gateways become your best friend. They centralize cross-cutting concerns like rate limiting (to prevent runaway AI agents), JSON Web Token (JWT) validation, request/response transformation, caching, and circuit breakers. This offloads common infrastructure burdens, making individual MCP servers more robust and easier to scale horizontally. It also helps manage "protocol evolution gracefully" as AI models and their requirements change. Caching strategies like in-memory, persistent, and multi-level caching further boost performance by reducing redundant API calls.

The Bad: Where MCP Servers Get Tricky

1. Complexity of Authorization and Multi-tenancy: The Devil's in the Details: While MCP uses standard OAuth, implementing robust authorization in a multi-user or multi-tenant scenario is far from trivial. You need meticulous attention to Protected Resource Metadata (PRM) endpoints, token validation middleware, and error handling.

   

   When multiple users are interacting with your AI agents, each with their own identities and permissions, you must enforce strict boundaries to prevent unauthorized access and data leakage. Every single database query, API request, cache lookup, and log entry needs to be precisely scoped to the current user. This isn't just about basic environment variables (which, frankly, are a "security anti-pattern in production" ); it demands sophisticated engineering and strict adherence to security best practices. The protocol enables secure multi-tenancy, but achieving it in practice requires significant investment in security architecture and operational rigor.

2. Operational Overhead for Production Deployments: More Moving Parts: Managing those traffic spikes from AI agents, transforming between different protocol versions as clients evolve, and consistently applying security policies across numerous server instances can be a headache. While AI gateways centralize many of these concerns, they also add another layer of infrastructure to configure and maintain. This contributes to the overall operational overhead of running MCP servers in a production environment.

3. Dependency on Host Orchestration: A Single Point of (Potential) Failure: The host application in the MCP architecture carries a lot of weight. It's responsible for "complex orchestration responsibilities" like managing client instances, connection permissions, lifecycle management, security policies, user authorization, and context aggregation.

   This concentration of control means the host can become a central point of failure or a performance bottleneck if it's not designed and scaled appropriately. The entire MCP ecosystem's effectiveness hinges on the host's robustness and proper configuration. So, while servers are easy to build, the host component requires careful architectural planning and robust engineering to ensure high availability and fault tolerance.

The Bottom Line

Model Context Protocol servers are a significant step forward for integrating AI into the enterprise. They offer a standardized, secure, and scalable way to connect LLMs to the real-world data and tools they need to be truly effective.

However, don't mistake "standardized" for "simple to deploy at scale." The complexities of authorization, multi-tenancy, and operational management in production environments are real and demand serious attention.

If you're looking to unlock the full potential of your AI agents and move beyond isolated models to deeply embedded, context-aware solutions, MCP is a critical piece of the puzzle. Just be prepared to invest in the architectural rigor and operational discipline required to make it truly shine.

The sad reality is, though, that while cybersecurity practitioners have been chanting the aforementioned phrase for decades, many organizations (and even security practitioners, themselves) continue to use compliance as an argument to fund cybersecurity initiatives. Compliance mandates such as GDPR, HIPAA, PCI-DSS, and CCMC establish specific security requirements that organizations must meet to demonstrate a commitment to the rules. As such, security teams have learned to effectively lean on compliance to secure funding for new resources, tools, and staff.

One study conducted by Swimlane found that 92% of organizations surveyed increased budget allocations for cybersecurity due to regulatory changes. A separate study by Bright Defense found that 66% of respondents cited compliance mandates as a primary driver of security spending.

Given that failure to meet compliance can result in fines, operational impacts, and reputational damage, business executives are prone to invest in compliance efforts, and smart security teams recognize that this is a lever to push when advocating for bigger budgets and supplemented support. Compliance is a handy tool when all else fails on the security funding front.

What’s more, compliance isn’t the worst tool to use when trying to prop up a security program; compliance can lay the foundation for a healthy security program — a starting block of sorts. Regulations are often accompanied by guidelines, frameworks, or even checklists that can be used to review implemented security processes, procedures, and technologies and identify areas in which programs fall short.

It’s like making a pre-vacation packing list: Surely you know to always pack your toothbrush. But in the craziness of planning to temporarily leave your home, job, perhaps kids or pets, and everyday responsibilities, things can easily slip through the cracks. Having a checklist handy to remind you of the little things — the rote tasks that are burned into our muscle memories — can prevent oversight and ensure you don’t walk around with bad breath and a mouth masquerading as a petri dish.

This is the mindset, I believe, security practitioners can use successfully when facing the reality of regulations. Active compliance requirements are just that — requirements. Use them as your baseline and as a way to further more effective cyber strategies, controls, and processes.

However, the question of compliance is contentious, to say the least. Some individuals argue that compliance regulations are governments’ attempts at controlling private entities. Others maintain that, without mandates, too many organizations will cut corners and put people, data, and systems at risk with sloppy security practices. Both points of view have validity.

For now, however, compliance remains.

Compliance in the Crosshairs

When it comes to the highest levels of government in the U.S., as of January 20, 2025, things have started to change. The first thing Donald Trump did after his inauguration was issue sweeping Executive Orders and directives, aiming at total government reform.

One of Trump’s notable actions was revoking former President Biden’s 2023 Executive Order on artificial intelligence. While not strictly focused on cybersecurity, EO 14110 included numerous implications for cybersecurity. It should be noted that, to date (January 24, 2025), EO 14028, Improving the Nation’s Cybersecurity, issued in May 2021, has not been revoked or challenged by the current administration.

Looking at the actions on January 20th, one could say that the revocation of EO 14110 was a simple matter of political realignment and an effort to keep U.S. technology companies at the forefront of innovation. Tech moguls are not fond of government constraints, and we’ve seen several Big Tech billionaires recently cozying up to the current president, who has regularly promised to do away with what he considers tedious regulations.

This one issue wouldn’t be indicative of much, then, if examined in isolation or in light of Trump’s other reforms published Monday. Except that, on January 22, 2025, a mere two days later, another hit to cybersecurity was handed down: The Trump Administration terminated all memberships of advisory committees that report to the Department of Homeland Security (DHS). The terminations include members of CISA, the agency formed under Trump during his first presidency, established to bolster the U.S.’ efforts in preventing physical and cyber threats to our nation’s critical infrastructure.

CISA’s Influence on Cybersecurity

Irrespective of political beliefs, the formation of CISA in 2018 was a positive and promising step toward increased support for and attention to cybersecurity — something cybersecurity practitioners had been longing for.

Following the establishment of CISA, and throughout the four years of the Biden Administration, cybersecurity regulations tumbled forth from individual U.S. states, riding the wave of CISA’s progress. As of June 2024, 20 U.S. states passed consumer data privacy laws, with eight more states slated to implement similar regulations in 2025. In 2022, 24 states enacted ~ 41 bills related to cybersecurity. In 2023, the National Conference of State Legislatures (NCSL) tracked “at least” 130 cybersecurity bills that were enacted in 39 states plus Puerto Rico and Washington, D.C.

Things cybersecurity-wise appeared to be progressing nicely after Trump’s initiative, despite his many disparaging comments about “the cyber”.1 Regardless, Trump started to sour on security to an even greater extent during his reelection campaign, beginning with the unceremonious firing of Chris Krebs, a highly-regarded member of the security community and then-Director of CISA, in November 2020.

Changes at the Helm of Government

Flash forward to the 2024 election and Trump’s return to the presidency. Several key players at CISA announced or submitted their resignations: Jen Easterly, former CISA Director, Nitin Natajan, former CISA Deputy Director, Jeff Greene, former Executive Assistant Director for Cybersecurity, and David Mussington, former Executive Assistant Director of Infrastructure Security all voluntarily vacated their positions. Importantly, these individuals were all Biden appointees, meaning, even in a normal election cycle, it’s typical to see turnover. But to see such drastic turnover, tailed by the revocation of a previous president’s Executive Order and the dismantling of an important oversight committee, has many cybersecurity practitioners on edge.

And there’s good reason.

In the days leading up to and following the inauguration, we’ve seen several major U.S. company executives reverse their positions on initiatives originally intended to better society, communication, and cooperation. Not surprisingly, the “about faces” all align with Trump’s beliefs and stated intents, including his intent for large-scale deregulation.2

Although cybersecurity regulations in the U.S. are currently implemented at the state level, and thus not ultimately determined by federal law, it would still not be surprising to see state officials back away from passing new or updated regulations in the next four years. There are a few reasons for this (beyond trying to curry favor with the president):

1. Republican-Controlled Congress: Congress is currently predominantly Republican, and Republicans generally favor anti-regulation. The party traditionally supports free-market policies, limited government intervention, and deregulation, arguing that excessive regulations stifle economic growth, innovation, and job creation.

2. Industry Pushback: Just as we’ve started to see Big Tech rolling back other corporate policies (such as DE&I), those executives will likely start to lobby for looser cybersecurity and privacy policies that will allow them to cut back on the cost and effort to maintain compliance. They might argue — as was the case with the AI Executive Order — that regulations repress innovation.

3. Tone at the Top: It may be cliché but it’s true: The values and culture set by senior executives influence governance, behavior, and decision-making. Trump has demonstrated his predilections, and we’re not likely to see them change in the next four years

So What for Cyber Compliance?

The fact is, we already have numerous cybersecurity and privacy regulations, frameworks, and best practices to choose from — and most of them (if any) are not going to be revoked. But they need to evolve to remain relevant. If the current U.S. administration does not advocate for evolving compliance standards, and it does not appear that they will, security practitioners must hold themselves to a higher standard. This is not the time or place to take the wheels off and see how things roll.

If we look at compliance as the base, the foundation, or the “lowest bar” in cybersecurity, we can continue to upscale cybersecurity programs that protect our businesses, our data, and our people without new or improved compliance mandates.

The reality is that we don’t need compliance to do better in security. But doing things without compliance only works if the cybersecurity community is 1,000% committed to improvement without government oversight. It only works if cybersecurity teams and CISOs can effectively communicate the risks of a breach, data leak, or disruption caused by a compromise. It only works if the industry holds itself more accountable, builds products that actively and continuously reduce the number and severity of cyber incidents, and responds to issues quickly and without finger-pointing.

Compliance mandates are only necessary if security practitioners don’t insist on and commit to best efforts without someone else looking over their shoulders. So far, we’ve proven that we do need cybersecurity compliance.3

Cyber Threats Wait for No One

Cybersecurity regulation is necessary when efforts are lagging, when things regularly fall through the cracks, and when people and businesses try to cut corners. In the case of cybersecurity, compliance establishes safeguards and guardrails. They set minimum standards, create frameworks, demonstrate commitment, build trust through demonstrable proof — and ensure accountability.

We can do better. We must do better. Is it going to be easy? No. Is writing this overly verbose article a hell of a lot easier than keeping threat actors at bay? Sure is. But cybersecurity shouldn’t be a place for laziness, nor should it be a comfortable job that outsiders can’t question because they “don’t understand” what we do. The time for ambiguity and mystery in our field is long gone.

For those opposed to regulation, it’s likely you’ll see a reprieve for the next four years. But if you think this is a time to slack off, please go find a job in a field with far fewer repercussions. For those in favor of regulation, write your own. Make it clear. Make it actionable. And most of all, make it more rigorous than if a politician wrote it.

Whether or not you believe in regulation, one truth remains: Cyber threats won’t wait for governments to act. Security leaders must take the initiative — build security into development processes, prioritize risk-based decision-making, and champion cybersecurity at the highest levels of business. The future of cybersecurity won’t be dictated by lawmakers alone; it will be shaped by the decisions security practitioners make today.

Originally published April 6, 2023

From the U.S. to the E.U., lawmakers are banning TikTok from government-owned devices due to concerns about the platform's Chinese parent company, ByteDance. Now, the U.S. government is considering whether to ban it entirely.

Social media excels at using targeted content for personal/professional/political gain. It exists, almost entirely, for its users to exert influence. Staunch critics have long argued that this kind of information exposure and sharing is dangerous for myriad reasons. Now that one of the most popular apps in the world is subject to the laws of a Communist regime, U.S. government officials and some private citizens are taking a hard look at the implications of its widespread use.

Will banning TikTok actually improve national security?

Social media is a big part of many Americans’ lives. According to the Pew Research Center, approximately 82% of Americans between the ages of 18-49 use at least one social media site daily. For most users, there is the tacit understanding that using a free social media site means that they are the product. Translation: When any site offers up fun and games for free, and the user is required to input personal information, the platform’s provider (“technology company”) is mining that personal data for financial gain. The provider is also tracking usage to understand user trends, habits, and preferences. When it comes to social media, in particular, frequent, heavy usage returns more data to the provider, making the user that much more attractive for data harvesting and targeting. The Cambridge Analytica scandal featured this fact, front and center. Many other tech company gaffs have kept privacy issues top-of-mind since.

Despite well-known personal privacy concerns, the seedy underbelly of social media has evolved. There is no end to how people will use social media sites and apps. They have become a symbol of personal expression and freedom of speech, a mechanism to reach an audience devoid of geographic boundaries. When it comes to posting ideas and opinions, Americans have a lot of leeway in what they can write or say, due to their First Amendment rights. Whether the information is true, partially true, mostly distorted, or entirely fabricated, social media users in America enjoy their freedom of speech.

Social media is also a haven for so-called self expression, or “alternative facts,” even though the true aim of this “information” is influence. Influence, in all its forms, has one goal, and that’s to affect others’ thought processes. Oftentimes this goal is well meaning. Other times…well…

Social media and “influence”

The spread of mis- and disinformation grew so egregious by 2017/2018 that MIT scientists published a massive study to show how and why “fake news” travels faster and farther than the truth. A main vehicle for mis-/disinformation: Social media.

Controversy on social media is, thus, not new. But most major social media sites were born and bred in Silicon Valley, giving U.S. users more comfort that any maliciousness was due to the founders’ unreasonable instructions to a helpless workforce. The concept of “influence” meant something completely different when it occurred on the platform of a U.S.-based organization. Many U.S. users thought (and still think) that misinformation/disinformation and “alternative facts” were/are problematic, but less so when they were/are perpetrated by their own people, in the U.S.

Then TikTok emerged — with a vengeance. Fueled by boredom during the COVID pandemic lockdowns, TikTok usage skyrocketed around the world, with U.S. adoption leading the way. Given worldwide social and political tensions at the time, the Trump administration honed in on the app’s Chinese ownership. TikTok is owned by the Chinese internet giant, ByteDance, which is headquartered in Beijing, and therefore subject to China’s National Intelligence Law which states that all Chinese citizens and companies must “support, assist, and co-operate” with Chinese intelligence efforts.

Now, it’s not like the U.S. doesn’t conduct its own surveillance on U.S. citizens (ahem, Edward Snowden). But, to many Americans, the idea that TikTok is run, in essence, by a Communist party is unacceptable.

At the time of the Trump administration’s proposed ban, courts were not ready to concede such an extent of wrongdoing by TikTok or its owners. Now, three years later, the U.S. government is concerned about the potential harm China could cause if it were to use the app and all the data it collects as part of its national security program.

Government warnings

In response to the Chinese government’s stance on data handling and personal privacy, both the FBI and Federal Communications Commission (FCC) have warned that TikTok administrators could be forced to turn over the data of any TikTok user. And TikTok’s data collection is excessive, just like that of Facebook, YouTube, Instagram, Tinder, Uber, and numerous other apps and websites. Nonetheless, Chinese ownership of TikTok has led the U.S. government (and several other allied countries) to ban its use on government-owned and operated mobile devices. The premise is that, by banning usage on government devices, the authoritarian and unfriendly regime can’t harvest user data that might be helpful in the Chinese government’s quest for worldwide totalitarianism.

This thought process is somewhat faulty, since users can always get around restrictions if they want to badly enough. However, banning a direct pipeline to data does erect barriers, at least, making it harder for the Chinese government to get their hands on U.S. government employees' data and actions directly.

But as time has gone on, U.S. lawmakers have started thinking again about a total ban on the app for all U.S. citizens. To prevent that from happening, TikTok has been putting significant effort into restructuring the company. They’ve opened a U.S. office, hired U.S.-based executives, and are migrating all the data of U.S. users to servers controlled by Oracle, an effort they’re calling “Project Texas.”

Is the juice worth the squeeze?

Despite TikTok’s moves, the Biden administration is not convinced; they are pushing for ByteDance to divest its interest in TikTok. Some security experts agree. Researchers who’ve seen what could happen at the hands of skilled attackers are also calling for a total ban on the app. Their argument: Any data collection engine is an attractive cyber attack target. A data collection engine with hundreds of millions of users who live in an area that said attackers want to dominate…that’s not a risk worth taking.

Despite their concerns, there is little evidence that ByteDance is actually conducting any nation-state activity on Bella Poarch, the British Promise Cats, or any of the other 3.5 billion users worldwide. Still, the potential exists. Plenty of adversarial regimes have carried out covert operations — using social media — in the past, only for the victim nation to find out they’ve been duped at a later date. So could China be secretly harvesting U.S. users’ TikTok data? Sure. At this point, though, there is no evidence of it happening.

An additional concern has been expressed; given the amount of data collected on users, and how impressionable the general public is (see MIT study, quoted above), threat actors could use the app to brainwash users by deploying highly targeted content. In particular, lawmakers are concerned that the Communist government could feed pro-China messages via the app. In other words, Chinese officials could use social media influence to rally support for their causes and/or recruit “insiders.” This is what social media does best: taking content that is attractive to certain users and promoting it to them for personal/professional/political gain.

Tailoring content to users is not new. Again, U.S.-based tech giants do it all the time. Elon Musk even bought Twitter so he could push the messages he wants to push to his users and suppress any contrary points of view. However, critics of TikTok say that because of the way TikTok recommends content to users — by applying algorithms that target individuals — it could push pro-China sentiment to the most vulnerable users and manipulate them into becoming vehicles for Chinese disinformation sprawl.

Is TikTok a national security threat?

The real question is this: Is TikTok a national security threat? My answer? Potentially. But no more so than any other social media platform. We’ve already seen the type of damage that can be done. Facebook and the 2018 election is the prime example of how communication platforms (a.k.a. social media) can be manipulated by anyone with access (and again, where there’s a will, there’s a way, national bans be damned).

The threat of domestic influence using false rhetoric is just as likely as a foreign actor exerting their influence. We see it every day, on social media and in mainstream media. The only difference is that China is a politically adversarial nation-state that maintains horrific policies about how it treats humans. But really, most Americans are less interested in the human rights of Chinese citizens than they are the threat of nuclear war or Chinese companies stealing U.S. jobs.

In truth, Americans should be concerned with all of the above. However, globalization also offers tremendous advantages; it’s one of the ways Americans know, or can learn about, the inhumane treatment of Chinese citizens and try to affect positive change. Globalization gives people in underserved or underdeveloped countries more opportunity than in a world that operates based on geographic borders. Globalization financially benefits consumers because no one company or country can have a monopoly on building “the best” products. So we should not shun a global economy.

Regardless, there is no way to halt the worldwide financial engine that is greed and power. The U.S. is not going to stop buying products from China. Full stop. Should we? That’s a huge topic for a much more in-depth debate by people who are much smarter and more educated than I.

So, is the app really the issue? Maybe. It is a vehicle, a “fast pass” of sorts, to Americans’ data. But it’s far from the only way the Chinese government is surveilling consumers. It’s far from the only way China can exert its influence. It’s, today, the most widely deployed avenue of potential threat, and so the U.S. is attempting to mitigate a vulnerability before it becomes a true national threat.

But TikTok is just the tip of the iceberg. It’s getting the U.S. government a lot of good press, but let’s not put up a false flag. Fortifying systems and data repositories that contain actual national secrets, hardening access controls, preventing lateral movement inside networks, tightening up the supply chain, and more are critical efforts that need vast improvement, more so than TikTok.

Let’s not forget about defense in depth while we’re watching dance videos and wishing we didn’t have to triage yet another security alert.

The 2024 DBIR — and plenty of subsequent studies — highlight critical trends in software and application breaches. Application vulnerabilities are a compelling target for attackers, with many reported incidents stemming from weaknesses in software development practices. But it’s not just the piece of software or the individual application that’s the problem, contrary to popular belief. The software supply chain encompasses myriad components — every line of code, every library used to build the software, plus the development environments, testing tools, people, access controls, and more — which is why the software development lifecycle (SDLC) is so tricky to manage and so attractive to cyber criminals.

When thinking about holistic cybersecurity, then, it’s that shift of focus from a single application or piece of software to the entire software supply chain (including development processes and tools) that must occur. Why? Because the entire software supply chain presents a significantly broader attack surface than a single app, and it’s complete with numerous, moving and complex parts, giving attackers greater opportunity while challenging defenders to invest the time and effort in full-lifecycle protection

Knowing all this, let’s look at the scope of the problem and, then, even more prudently, look at how you and your team can improve the resilience of your software supply chain.

Increased Interconnectivity Equals Higher Risk

Software supply chain breaches occur when cybercriminals exploit vulnerabilities in any part of the SDLC, knowing that a successful exploit will have far-reaching consequences beyond that of the initial target. The 2020 SolarWinds attack is one example of how attackers used a software update to compromise the initial organization, the results of which were passed down to its customers. The incident highlighted just how damaging it can be when an attacker finds one crack in an extensive and extended ecosystem.

Exploiting Software Vulnerabilities

Lingering vulnerabilities are another important element of the supply chain equation. Poor software patching practices or unmanaged zero-day vulnerabilities can have cascading effects across entire industries. To illustrate, the average lifetime of a vulnerability is 4 years, and the average lifespan of zero-day vulnerabilities is 6.9 years. You don’t have to be a software expert to understand the inherent risk of letting vulnerability patching lag. 

Even when a software provider is technically the victim of these exploits, downstream entities bear the brunt of the damage, sometimes forcing security teams to deal with the fallout years following the incident. This is precisely why software quality control measures must improve and why rigorous patch management practices are paramount.

Escalating Threats of Ransomware and Extortion

Software vulnerabilities, once exploited, can lead to ransomware and extortion attacks. The DBIR describes how third-party supply chain issues directly drive these incidents, as attackers use vulnerabilities in software and development processes to infiltrate and lock down critical systems. Companies are then left with the difficult decision of negotiating with criminals (which is no guarantee of getting the data back) or facing operational shutdowns (when/if complete backups of systems and data aren’t available). Neither of these options is particularly attractive to businesses.

Targeting Malicious Software Libraries

The speed of software development and innovation has been accelerated through open-source libraries. In fact, it has been estimated that up to 90% of code is open-source. While this codebase reuse aids the development process, it increases the likelihood that one, tiny code flaw could cause widespread damage. 

Over the years, researchers have noticed a rise in the use of malicious libraries and packages in development ecosystems, such as those found in repositories like npm. Attackers focus on inserting malicious content into these libraries, including malware designed to steal credentials or compromise applications after installation, because it gives them the biggest bang for their breach buck.

API Exploitation: A Growing Attack Vector

API exploitation is on the rise, and these attacks are often part and parcel of supply chain attacks. The DBIR highlights that APIs are increasingly used as entry points for attackers, especially ones with weak or reused credentials. The more interconnected our systems are, the greater the risk. APIs are part of the ever-expanding attack surface, and threat actors have taken note while defenders continue to chase the attackers.

Access Controls are No Exception

Without access, no compromise can occur — software-related or otherwise. It’s no surprise, then, that attackers use malware to steal credentials stored or cached in compromised software environments. In some cases, organizations make it easy for adversaries by storing credentials unencrypted, allowing shared passwords and secrets, and over-provisioning privilege escalation. Locking down access controls, insisting on multi-factor authentication (MFA), and applying zero-trust principles to identity and access management are the best ways to shut entry points before attackers waltz through. 

Recommendations

Now that we know the problems contributing to software supply chain insecurity, here are the top recommendations for ensuring that your software supply chain is more resilient.

Implement Rigorous Software Vulnerability Management

Organizations must establish a robust vulnerability management program that includes continuous monitoring and rapid response to newly discovered vulnerabilities. Over the years, we’ve been shown time and time again that poor patching practices lead to devastating breaches. It’s critically important to identify the most business-impacting vulnerabilities and regularly update/patch software components. Especially when it comes to open-source libraries, AppSec teams must focus on minimizing the risk of exploitation. 

Automated tools with proven ability to prioritize high-risk vulnerabilities are mandatory, as no security team can expect to manually cull through the hundreds of thousands of alerts produced every day. Incorporating reachability, exploitability, and applicability analyses into vulnerability assessments will remove irrelevant alerts from the process and demonstrably drive down risk.

Incorporate Automated Workflows

Automating security actions can greatly enhance efficiency and reduce human error that can occur when managing the vastness of the software supply chain. By incorporating automated workflows, organizations can streamline vulnerability assessments, remediation processes, and compliance checks across their development and deployment environments. Automation allows AppSec teams and development professionals to focus on higher-priority issues by allowing technology to consistently execute routine tasks. Further, automation for rote tasks assures accuracy, thereby improving overall security posture while ensuring timely software delivery. 

Adopt Application Security Posture Management (ASPM) Tools

Implementing Application Security Posture Management (ASPM) tools significantly enhances an organization’s ability to manage and secure its software supply chain. ASPM provides continuous visibility into application security across the software development lifecycle, allowing DevOps and AppSec teams to identify vulnerabilities and risks early in the development process, and prevent issues from reaching production where they can become trickier to fix and costlier to remediate. 

ASPM should seamlessly connect to existing development pipelines and CI/CD tools, giving organizations the ability to continuously assess the security posture of their applications (including third-party components, dependencies, and environmental aspects). By embedding security checks and balances directly into the development process, ASPM provides both a stronger security posture and the freedom developers need to deploy feature-rich applications.    

Conclusion

As businesses navigate the complexities of the evolving software supply chain landscape, it’s clear that software supply chain security must be prioritized. The increasing interconnectivity of software and systems presents a broad attack surface that cybercriminals are eager to exploit. The lessons learned from high-profile incidents like the SolarWinds breach serve as reminders of the potential repercussions when vulnerabilities are left unaddressed. 

By prioritizing software resilience, AppSec teams can better mitigate risks throughout the SDLC and safeguard their operations more simply. Embracing proactive security measures, including ASPM, will not only protect individual organizations but will also strengthen the entire supply chain.

However, there is a vast difference between an occasional outburst and frequent or consistently bad behavior. The latter is something I’ve — unfortunately — seen quite a lot of during my years in security. 

Like many industry friends and colleagues, I’ve had a number of jobs over the years and worked with diverse groups of people. This is quite common. Security isn’t typically a field that sees many people staying in their role, or even at one company, for a decade or longer (unless you’re talking about small owner-operated consultancies). According to a recent survey by ISC2,2 “nearly 60% of cybersecurity professionals are considering changing jobs within a year, with some estimates suggesting an annual churn rate between 20% to 30% in certain roles.” In contrast, healthcare has an average churn rate of ~6% — and that’s for an industry with notably high pressures. SaaS companies experience a median churn rate of about 13%.

Why are these stats important? Because the number one reason people leave companies is because of poor management. The saying, “People don’t leave bad jobs, they leave bad bosses,” may be cliché but it’s not untrue. In fact, according to a Forbes report, “It's relatively common for managers to lose their tempers, harshly chastise or scream at a subordinate in front of other co-workers.” Yikes. Suffice it to say, the “research” for this article has been conducted over a number of years and with a large swath of security friends and colleagues who have reported working for bad bosses.  

5 Types of Bad Bosses

While “bad” can mean different things to different people, there are certain characteristics that commonly occur in managers who are considered “bad” by their employees and peers. These include: 

1. The Micromanager: This is someone we’ve all worked for at some point in our careers. This boss is someone who can’t seem to extract themselves from a subordinate’s day-to-day work, regardless of how big or small a task is. They have to see and scrutinize every single deliverable. And they never hold back with their corrective commentary. Furthermore, they don’t take kindly to employees asserting their own opinions and/or processes.

2. The Absentee: This boss is the manager who never seems to be available for guidance, advice, or simply to give a second opinion. This person is the exact opposite of The Micromanager; they don’t want any part of their employees’ daily activities, and they act annoyed when someone asks for their help. Yet, when things go wrong in the trenches, The Absentee is the first boss to blame their staff.  

3. The Spotlight Stealer: This boss takes their employees’ ideas and work and presents them as their own, especially to other managers, executives, and higher ups. One-on-one, The Spotlight Stealer may quietly praise the staffer who actually did the work, but their external M.O. is to present everything as a “team effort” with their ideas and labor at the helm.

4. The Poor Communicator: This person is typically a boss who thinks they are an expert communicator. They might say things like, “We discussed this in our last meeting,” yet the employee has no recollection of that conversation or can never find any details related to it. While bad communication can and does happen to everyone occasionally, employees who work under The Poor Communicator share the commonality that they constantly feel “in the dark” about what they’re supposed to do and how to do it.

5. The Blame Shifter and Favoritist: This boss will always find fault with their employees when things are not going well. They don’t take criticism well, and don’t ever think the team’s failures are their failures. What’s more, this boss frequently demonstrates favoritism for certain employees and will praise them in front of others to prove a point. Importantly, the “favorite” frequently changes based on who can make The Blame Shifter look good at a given point.

Does a Good Boss Exist?

Let me first start by saying that, despite the doom and gloom of the entire first part of this blog, good bosses do exist! I’ve worked for several!

My best bosses have been leaders who are/were encouraging and empowering without being intrusive. They were/are always there to answer questions, give advice, share previous work experience, and grease the wheels of an otherwise sticky project. They check in now and again, but also know when to stay out of the way and trust me to be an expert in my domain (which was, theoretically, why I was hired in the first place).

For instance, when I was in sales, I once had a boss who insisted on being on every call for the first three months of my employment. I thought that was going to be a complete and utter disaster. But instead of taking over the call or talking over me, this boss would send me instant messages3 with prompts of things to say to the prospect/client so I could learn and practice. It turned out to be a really effective learning tool and something I admired about this person. It taught me that my boss wanted me to succeed in this particular role (which they had been doing for many years), and didn’t need the ego boost of showing others how smart and savvy they were.

In another role (product marketing), I worked with some extremely technical people. At the time, I was just learning and couldn’t yet dig deep or even really understand a lot of the things security engineers or architects were saying. I didn’t want to be a marketer who couldn’t “talk tech,” but also had experienced the eye rolls of techies who assumed marketers and salespeople would never “get it.” The fear of being ridiculed made it hard to know whom to approach. Luckily, two engineers made themselves readily available and never belittled me, regardless of how rudimentary my questions were. They corrected without acting insulting, and they offered advice when asked.

In turn, they came to me when they had questions about something they had to write, or about the best way to message product features, status updates, and the like. These were incredibly supportive relationships that helped me learn quickly and boosted my confidence.

I also had a boss who shared every piece of product marketing collateral, every template, every productivity tool they ever used during their career as a marketer. This boss openly provided as much information as they could, accompanying it with, “Use it however works for you. I am sure you can come up with something better.” Even if I couldn’t, those words showed me that I had the freedom and flexibility to assert my own experience, intelligence, and process. This boss stretched me into projects I’d never worked on before, but with the support of their provided tools and suggestions, which helped me grow and evolve.

What Can You Do About a Bad Boss?

First and foremost, if you’re currently working for a boss that consistently exhibits the terrible traits noted above, start job searching ASAP! Reach out to your network, recruiters, and apply to jobs that look interesting and are a good fit for your skill set. Start today. Things won’t get better.

Walk away from a job that negatively impacts your life, increases your stress to unmanageable levels, and affects your personal wellbeing.

That said, one bad interaction with an otherwise good boss doesn’t necessarily necessitate a complete change of scenery. As hard as it may be, try to address the issue directly with your boss. If you don’t feel you can speak openly to your boss about the negative experience, seek professional help from your HR/People team (if you have one) or a career counselor. These are professionals trained to help employees through rough patches and provide the resources and confidence to try to remedy a bad condition. If the boss is actually a good boss, you will start to see a shift in their behavior. If you don’t, start warming up to run for the hills.

When it is clear that your boss is simply a bad boss and they don’t demonstrate any desire to edit their behavior, here are a few traits that industry professionals say constitute a good boss:

1. Motivating and empowering: A good boss listens to their employees, identifies their strengths, and helps them find growth opportunities. The boss is always available for advice and guidance, but also knows when to step back and allow the employee to work on their own, implementing their own ideas and processes.

2. Sets clear expectations: From project requirements to priorities, deadlines, and everything in between, a good boss sets and documents clear goals, metrics, and timelines. When objectives or goals change (as they do) those updates are communicated effectively and to everyone involved. 

3. A good communicator: This one is tricky because no two people communicate in exactly the same way. However, a good boss understands individual employees and what resonates with them. They work hard to deliver information and messages in a way that resonates with that specific person. When addressing a group, a good boss will ensure that all team members clearly understand before moving on to another topic.

4. Trusting and supportive: A good boss hires good people and trusts and supports them, even during difficult times or when things simply aren’t going right — especially when things aren’t going right! A good boss will do the “blocking and tackling” for their employees and can be counted on to deflect obstacles or blame if they stand in an employee’s way. 

5. Provides productive feedback: A good boss is quick to praise strong work but also teaches and corrects when things aren’t going well. Importantly, a good boss communicates feedback in a positive way, even if the underlying message is a hard one. Chastising or belittling is never acceptable, and a good boss would never consider delivering difficult feedback in a way that makes an employee feel small.

Conclusion

The cybersecurity industry can be demanding and stressful, resulting in occasional negative behaviors. While sporadic outbursts are understandable, even from the best bosses around, frequent bad behavior creates a toxic work environment and harms employee morale.

Bosses play an important role in creating a positive and productive work environment. Good bosses motivate, empower, communicate effectively, and provide support to their employees. They foster a positive and collaborative atmosphere, and help mitigate the negative impacts of stress that are inherent in every work environment.

Thus, while bad bosses do exist, so do standout managers. When you find a good boss, you will immediately notice significant improvement in your career satisfaction and overall well-being. 

If you are working for a good boss, let The Cyber Why crew know why you think this person is great. We’d love to hear more positive stories in the industry.

Katie Teitler-Santullo, owner and writer of The Reformed Analyst, says that the move will foster greater communication and debate about and in cybersecurity. Teitler-Santullo will join Tyler Shields (Founder and analyst), Adrian Sanabria (analyst), Rick Holland (analyst), and Jennie Doung (head marketer) to muse on various security topics, write controversial advice, provide unprovoked and highly-subjective commentary, and generally call out BS in infosec.[i]

“I am excited to join these industry heavy hitters and perhaps have an external edit on one of my bi-weekly articles prior to publication,” said Teitler-Santullo. “It’s been amazing to see the growth of The Reformed Analyst over the past year and a half,” she continued, “but to improve my sarcasm game, I have to work with the best, and that’s Tyler.” Teitler-Santullo says that nothing about her articles will change except that they will now be part of a bigger industry conversation and will be marketed through The Cyber Why.

Current Reformed Analyst subscribers can opt in to The Cyber Why (TCW) by clicking on the link below.[ii]

Subscribe to TCW

By subscribing to TCW, readers will have access to all Teitler-Santullo’s upcoming content as well as all content published by TCW authors.

Terms of the agreement were not disclosed but are rumored to include copious amounts of chocolate.

[i] This last piece was directly plagiarized from Sanabria’s The Cyber Why bio

[ii] She also promises this is not a trick, unless you consider a newsletter subscription spam

Subscribe to TCW for free

In this article, we’ll look at a few statistics and explore a few ideas that might be useful in managing the stress that leads to burnout. Maybe you’ll read something new. Maybe you won’t. But maybe just one person will read this and make a small change that can save their life.

Cybersecurity professionals are prone to high levels of stress. Between the continuously growing and always-on cyber attack surface and the deficit of skilled workers, practitioners tend to work long hours, deal with business-impacting problems, and often feel they don’t get the recognition or support they need. What’s more, many industry professionals count security as both their work and their passion, meaning, time away from “work” revolves around work. Case in point, it’s not uncommon to hear security colleagues talking about the security research they’ve done after traditional work hours, the new tools/technologies they’re building in their “off” time, or the industry meetups/conferences/gatherings they attend at night or on the weekends. They never seem to find time away from security.

Now, this isn’t necessarily bad. Some wise person once said, “Do what you love and you’ll never work a day in your life.”1 However, an always-on status can take its toll on a person’s mental and physical health, even if the subject of attention holds a positive position in a person’s life.

Stress is an inevitable part of life. There is “good” stress and “bad” stress. “Good” stress can push a person to perform better, ignite a desire for change, and motivate. It activates the “fight or flight” response that can be useful when facing a life threatening situation. When experienced acutely and sporadically, “good” stress helps improve people’s lives. 

The problems arise when there is “bad” stress, or chronic stress. “Bad” stress is the stress that causes high blood pressure, sleepless nights, headaches, hypertension, heightened agitation, anxiety, decreased performance, poor concentration, chronic pain, depression, and many more unhealthy and unwanted symptoms. Unfortunately, “bad” stress is very common. And when people don’t have or can’t take advantage of outlets that relieve “bad” stress, it builds up, causing devastating effects.

Stress by the numbers

When it comes to cybersecurity, the signs of bad stress are everywhere. According to a State of Mental Health in Cybersecurity report, 66% of survey respondents revealed that they feel significant amounts of stress at work, and 63% said their stress level had risen over the last year. Does this automatically mean those surveyed were referring specifically to “bad” stress? No, of course not. However, in the same report, nearly a third of respondents considered the state of their mental health to be only “fair” or “poor” due to extreme stress at work. Further, two-thirds of these respondents said they felt burned out at work. Science tells us that unrelenting or extreme stress leads to burnout, which is classified as a state in which people feel debilitating effects such as the ones listed above.

Other reports are even more concerning. CyberArk conducted a study that found 59% of cybersecurity professionals to be suffering from burnout. Eighty-five percent of respondents to a Devo Technology study said they anticipate they will leave their role due to burnout and 24% say they will quit security entirely. 

The numbers aren’t good. 

High stress rates and burnout are talked about frequently in cybersecurity, and it’s easy to get caught up in our own bubbles; security is, in many ways, just as much a community as it is an industry. This predicament leads to a bit of an echo chamber, making the problem feel even more immense than it is (and it is, per the statistics, not good). But we also have to look more broadly at the world we live in and our role and responsibility in it. 

Cybersecurity: Not a unicorn

In preparation for writing this article, I read ten different publications that detailed the “most stressful jobs.” Not one mentioned cybersecurity or even IT. This does not minimize the experience of working in cyber — it is a stressful job and burnout is a real and persistent problem. However, the available data can help us understand that the scope of the problem is bigger than ourselves, and use lessons learned in other industries and job categories to improve our own lives, ameliorate stress, and reduce the likelihood of burnout. 

As individuals, companies, healthcare providers, and other entities have acknowledged that “bad” stress and burnout cannot be ignored or written off as individuals’ personal problems, more resources have become abundantly available over the years. Many companies now support employees by providing wellness tools, educational materials, flexible schedules, mental health days, paid time off for volunteerism, onsite gyms or credits to outside exercise facilities, and — most importantly — greater openness and communication about mental health, company expectations, and personal growth.

Employers bear a big responsibility when it comes to supporting employees and helping them alleviate unnecessary stress and burnout. It hurts the bottom line if they don’t (plus it makes you a $h!t+y person if you don’t care about others’ well being). All that said, our own health, be it physical or mental, is ultimately our own responsibility. Employers, family, friends, doctors, therapists, coaches — they can all act as a support system. But the true responsibility lies within. 

As such, taking care of our own mental health, finding ways to reduce the bad stress that leads to burnout and its various unpleasant symptoms, needs to be a priority. Fortunately, recent history and the prevalence of stress and burnout at work (across industries) can provide guidance. 

Set expectations: There will be things over which you will have little control, be it attacker tactics and techniques or how your boss acts. Find ways to accept lack of control in certain areas — Repeat a mantra. Practice breathing exercises. Find a non-work friend to vent to — so you can focus on that which you can control. 

Manage your time: There is a belief among certain people that the more hours you work, the more valuable you are as a human being. Nothing could be farther from the truth. What’s more, excessive work hours without physical and mental breaks will lead to mistakes, poor concentration, and health issues. While it's inevitable that you may be required to work longer hours at times, be deliberate about your time. Keep a journal and track what you’re actually doing during the day. Map it to your work responsibilities. Doing so will help you understand where and when you’re actually wasting time, being inefficient, and causing yourself more stress. 

Prioritize self-care: This means something different to every different person, but self-care includes ways to replenish your mental and physical energy. For some people, it might be as simple as getting more sleep on a regular basis, exercising more, or eating more nutritious foods. For others, it could be taking a walk in the woods, reading a book, learning a new hobby, practicing mindfulness, turning off social media, playing with your kids, dancing with your friends…or anything else that makes you truly happy. It isn’t what you do; it’s about how you feel. If you’re content, if you’re smiling, if you feel relaxed — then you’re practicing self-care and removing some nasty stress from your life.

Learn to say “no”: This one is tricky, because there are many things each day to which we, as adults and employees, can’t say “no.” “Katie, please write a new datasheet on the new feature the product team just released.” “No, boss.” That is a sure way to get yourself fired, thereby increasing your stress a zillion fold. So don’t do that. But do find areas in both your personal and professional life where you can say “no”; request help from friends, coworkers, or family; or even push back a deadline to make a job-related task more manageable. 

Seek help: If you’re beyond stress and into the danger zone — burnout — seek professional help. Use your personal network too; sometimes there’s nothing like a family member or good friend to help you turn things around. But if you’re seriously burned out, talk to a mental health counselor, see a doctor for physical health concerns, speak candidly to your HR department, or hire a career consultant. Overcoming burnout is a serious condition that requires dedicated effort and assistance. It will also lead to big changes in your life. Be open to those changes, and let experienced professionals assist you. We’re fortunate that we live in a time where burnout isn’t considered a personality flaw, so use available resources to build a plan that will take you from burned out to thriving. 

Whatever you do, recognize that you’re almost never stuck; burnout and/or extreme stress are not inevitable. The tips listed above are tried and true; many other industry professionals face (at least) similar stress to that which is felt in cybersecurity. Draw on the experience and expertise of others to improve your life, start feeling happier, and become a healthier person.

In this article, we’ll look at what went wrong and explore how buyers can be a force for positive development in the AI evolution.

“Shrinkage” is a top topic in the retail world. Brick and mortar stores have an obligation to curtail as much theft as is possible in order to maintain a healthy bottom line, and surveillance cameras have, for decades, been a reliable tool in that endeavor. What’s more recent, however, is the use of AI-based facial recognition technology in retail stores. In theory, when the technology is top-tier and the humans using it are knowledgeable and honest, it can be an effective approach. But when these elements are missing, that’s when trouble sets in. And that’s apparently what happened at Rite Aid.

In the Rite Aid case, the FTC “charges that the retailer failed to implement reasonable procedures and prevent harm to consumers in its use of facial recognition in hundreds of stores.” But reading more deeply into the charges, it’s clear that this is more than a case of mere negligence. Not only did someone or a team at Rite Aid corporate decide to buy and implement facial recognition software at some of their stores, but according to the FTC report they also: 

• Chose a problematic vendor;

• Did not test for or request audit information about the accuracy of the vendor’s system before implementation;

• Did not test or monitor the system for false positives during the deployment period;

• Allowed inadequately-trained employees to make decisions about potential shoplifters, based on unchecked data;

• Failed to inform shoppers that facial recognition technology was in use;

• Discouraged employees from revealing information to shoppers about the program; and 

• Allowed low-quality images from store CCTV cameras, mobile phone cameras, and mass media articles (so, pictures of pictures…) to be used as data inputs.

Regarding the first bullet — choosing a problematic vendor — a Reuters story from 2020 detailed how Rite Aid selected an AI-based facial recognition vendor whose product was known to produce high false positive rates, in particular, when it was used to identify people of color. Further, irrespective of the quality of the tool (or perhaps because of it) the vendor reportedly included language in its customer contracts that denied liability for inaccuracies in data processed by the tool — something that should have, at least, signaled caution to buyers. 

Thus, precarious decision-making on the part of Rite Aid execs is evident from the get-go. Continuing down the list, any of the bullets would constitute a very poor IT or cybersecurity program. None of these things, in isolation, should happen when IT and security teams are skilled, trained, abiding by industry standards and frameworks, and held accountable for their actions. In totality, Rite Aid’s actions should be abhorrent to any security or IT practitioner with a modicum of integrity. Oh, and I’d be remiss if I didn’t mention that the December 2023 FTC ruling came 10 years after it imposed charges on Rite Aid for “failure to protect the sensitive financial and medical information of its customers and employees.” In other words, Rite Aid has a history of disturbing data security practices (or maybe non-practices).

AI improvement, but still far from perfect

As interest in and use of artificial intelligence (AI) grows, builders and buyers of AI are going to have to take a larger governance role, ensuring that its outputs are used for good rather than harm. While Rite Aid tried to sidestep the issue of wrongdoing by stating that the company stopped its use of the facial recognition technology three years prior to the FTC’s investigation, the investigation uncovered that Rite Aid failed to properly vet the technology before using and deploying it, and additionally failed to allocate the proper resources to safely manage the surveillance program. The three year lag is not terribly relevant.

Still, we have to account for history. Facial recognition software was not terribly accurate or reliable in 2012, when Rite Aid first deployed it. What’s more, guidelines and established processes for using it were extremely limited back then. So could Rite Aid simply be remiss for buying and using a spotty technology when better options were not yet commercially available? Perhaps. The vendor probably shouldn’t have been selling software with so many flaws. However, they did cover their a$$ets in their contracts, which should have been a huge warning flag to buyers that the onus would be on them to use the tech properly, to analyze the results carefully, and to take ownership for any decisions and actions resulting from the technology’s use.   

Then there’s the next big question: Should Rite Aid have upgraded its facial recognition program as more accurate systems became available? 

There is undeniable proof that facial recognition technology has improved a lot in the last twenty years, including the eight years Rite Aid was using it. One NIST study claims that "high-performing" algorithms produce a 20X improvement since 2013. This means that Rite Aid had plenty of opportunities to upgrade the technology and to correct any misuse or faulty practices. 

What does it mean?

The recent charges from the FTC are notable because it’s the first instance in the U.S. in which a government body has imposed restrictions on a business. This should not be too surprising for anyone watching what’s happening with AI in the workplace. Though many people are bullish on AI, there are a lot of concerns about its unchecked power. And, to be sure, many companies are forging ahead with AI-based products and services without putting enough time and attention into the algorithms and training models. And you can’t have one without the other when it comes to AI; a good algorithm with bad data inputs will result in inaccurate outputs. On the flip side, a badly written algorithm, even if the training data is as clean and accurate as can be, won’t produce reliable results. Rite Aid was using bad technology and bad data. They hit all the “bads.”

But back to the ruling and its general impact  — what does this mean for facial recognition technology builders and buyers today? 

NIST and facial recognition testing

To encourage innovation and improvement, the National Institute of Standards and Technology (NIST) provides guidance, data, and testing for many areas, including facial recognition. The NIST Face Recognition Vendor Tests (FRVT) program, initiated in 2000 and split into two subsections (face recognition and face analysis), tests vendor offerings for accuracy. As noble as their efforts are, the FRVT is limited by its own data inputs. 

To start, all testing is voluntary, which means that only a small subsection of existing vendors is tested. Substandard vendors are not required to participate, which makes it extremely difficult to assess how well facial recognition tools, as a whole, perform. 

Second, NIST recognizes that the industry has not yet standardized, which means that vendor offerings can’t always be compared. It’s challenging to determine the accuracy of a category of technologies when each vendor’s components vary widely. Further, many vendors don’t want to reveal their “secret sauce,” meaning they won’t open up all components to testing.

As long as vendors are not required to certify their offerings, abide by regulations, or be held liable when their technology is misused or abused, low-quality products will exist. If low-quality vendors offer low-cost options, some buyers will take their shot at using them and gamble on the outcomes. 

Present-day status

What NIST is able to assess, however, is general trends in facial recognition technology accuracy. According to one recent report, “Accuracy varies notably across algorithms and that algorithms’ accuracy varies across different types of images.” While the data in this report is somewhat skewed, leave it to The Reformed Analyst to take a contrarian point of view.

The report says that “Forty-five of the 105 identified algorithms were >99% accurate when comparing probe templates from high-quality images to a gallery of 1.6 million templates from high-quality images.” Yay! What reliable technology we have!

Hold up: Let’s read that a little more closely: Less than 43% of algorithms have greater than 99% accuracy. So, quite a bit more than half are less accurate, though the report doesn’t detail by how much. It could be 98% or it could be 22%.

That same positive statement turns a little less impressive when the number of templates is increased to 3 million. In that test, only three algorithms maintained the same level of accuracy.

When it comes to assessment across race and sex, the results grow more dim. If you have time, scroll through this 82-page report published by NIST. In short, false negatives and false positives vary tremendously by algorithm but are both notably higher for Black, Latino, and Asian individuals and women than they are for white men. Further, there is less accuracy in identifying young and older individuals than middle aged individuals.  

Looking forward

What this means is that the current state of facial recognition technology is inconsistent. For some use cases, it’s an excellent solution. For others, it isn’t there yet. It also means that users will have to be diligent about how they use the technology, irrespective of the efficacy (demonstrated or self-stated) of the vendor offering. A company that buys a great technology — be it facial recognition or otherwise — must:

• Properly vet the vendor before signing a contract

• Monitor and audit data outputs during use

• Establish best practices for operating the tool

• Maintain governance over actions resulting from the technology’s use

Failure to do so will result in poor decision making and possibly worse. In the case of facial recognition technology, we’re talking about data privacy issues, bias and discrimination, personal harm, and the intentional or unintentional spread of disinformation and misinformation. That’s just to start.

All of the above being said, this post is not meant to be a warning. It is meant to level set the state of AI-based products and facial recognition technology. It is also meant to be a reminder that no technology is plug-and-play. The “best” products in the world aren’t fruitful if they are mismanaged (or unmanaged). And good decisions can’t be made using flawed data. As a security community we all have a responsibility to continuously improve processes and people skills. Technology is just one tool in the proverbial toolbox.

Last year I published my “Top Cybersecurity Trends” article, and due to its popularity, I’ve decided to bring it back, complete with updates on the market and a little silliness to get you through the hectic holiday season.

Settle in with a sugar cookie and some eggnog and read on to see what, in my opinion (for whatever it’s worth), is and will continue to be trendy in 2024.

It’s that time of year again — the time when every security sage publishes about what will be hot in the industry in the upcoming year. These posts come in three primary forms. The first and most common are “predictions and trends” lists that simply assemble common security topics and/or try to elevate things every security pro should know. So far this month I’ve read in these types of articles that “mobile is a new threat,” “cloud is ‘potentially’ vulnerable,” and that we will see “targeted ransomware emerge.”1 Hey, Doc! It’s Back to the Future!

The second popular variety of these lists are those that aim to scare the bejesus out of people, especially non-security folks: “Everyone will be at risk of personal data exposure!” “State-sponsored warfare will target individuals!” While written with a modicum of truth attached to them, let’s hope FUD tactics finally die in 2024.

The third type focuses on vendor spokespersons sharing their “predictions and trends” that center around their organizations’ product(s). For this, I can’t fault the authors. Everyone’s anxious for airtime, and it’s employees’ responsibility to ensure that their company gets their fair share. Not to mention, if you work for a company and don’t believe in their product, I predict that you’ll want to look for a new job in the New Year. 

As for me, I’ve been preaching that it’s all about getting the “security fundamentals” right. I’ve been saying it for years.2 I predict, therefore, I will continue to do so in 2024.

But, as I’ve positioned this as a “trends” report, and you’ve presumably come here to read what I think is going to be trendy, let’s look at a few areas that will remain pertinent for cybersecurity professionals in 2024.

Artificial Intelligence Everywhere

Believe it or not, 2023 wasn’t the first year artificial intelligence (AI) trended as a topic in cybersecurity. Companies have been conflating AI with machine learning for at least a decade, and vendor marketing teams have been sprinkling both terms into their collateral for a long time. 

But with the launch of ChatGPT more than a year ago, businesses have more accessible AI-based or AI-like tools at their disposal, and the hype has gone through the roof. On the vendor side, we see frequent announcements about how AI and large learning models (LLMs) are enhancing and enriching existing products. On the end user side, employees are rapidly adopting AI tools that guarantee greater speed and efficiency — so much so that many businesses have had to rapidly publish acceptable use policies for how and where AI can be used in employees’ day-to-day work.

AI will, for certain, change the way in which people work and in which technologies process data, including sensitive and proprietary data. And while AI affords greater speed and efficiency for many tasks, we’re not at the “let the robots do their things” stage yet. We’re not even to the sentience stage yet.

As many technology professionals warn, we should proceed with caution when it comes to AI. But I predict that most companies will not proceed with caution when it comes to AI messaging. 

Year-end conclusion: In 2024, we will see more and more companies declaring their use of AI as a core component of their products and services. Under the covers, much of the “AI” will actually continue to be machine learning, but the hype will heighten. 

Cyber Crime Sophistication

While I recently joked to a security friend that I was tempted to write, “‘AI’ will be added to every cyber vendor marketing campaign” for every trend in this report, there are other trends that will loom. One of those is increasing cyber crime group sophistication. Now, the fact is, cyber crime groups do and will use AI to become more savvy over time. They are probably miles ahead of the rest of us already. 

Even if they are not significantly far ahead with AI, in particular, they are reliably and regularly using automation and corporate practices (such as employing marketing professionals). Doing so ensures that their schemes are successively more realistic and plausible. 

Year-end conclusion: With big budgets and trained professionals at the helm, threat actors will continue to improve their tactics and techniques in 2024, creating stealthy messaging and traps that will be hard to spot, even by present-day detection technologies. 

Continued Tools Consolidation

While reports show that cybersecurity budgets are growing, recession fears and a slow funding market from the last few years have made businesses cautious about what they’re spending money on. Most enterprises maintain an overabundance of security tools deployed in their tech stack. In fact, a survey of RSA attendees revealed that 43% of security professionals “say their number one challenge in threat detection and response is an overabundance of tools.” 

It’s no surprise, then, that 75% of security teams said they were pursuing vendor consolidation in 2023. It doesn’t take rocket science to see the perpetuation of this trend. As the tools market waxes and wanes, with vendors acquiring or building products that take an integration approach, it’s easier to flesh out redundancies. With the explosion of asset management vendors, businesses can more easily see where they have overlaps and use that data to sunset iterative technologies or ones no longer serving a defensible business purpose.

Year-end conclusion: Many security teams will pursue consolidation in an effort to optimize the tech they already have at their disposal. Any new tools acquired must support an integration approach, and (in addition to any technical benefits) they must serve the purposes of speed and accuracy. 

Cyber Insurance and Regulation Increases

Cyber insurance is the fastest-growing subsector of the insurance market, and for good reason. Businesses’ attack surfaces are expanding all the time, and organizations fear financial losses due to the disruption a compromise can cause. In some cases, banks and other funding sources are requiring the businesses they’ve invested in to obtain cyber insurance, even if the laws and regulations do not yet say so. But that could be changing.

For instance, the new SEC regulation just hit on December 15, 2023. Though the rule focuses on disclosure and does not specifically mention cyber insurance, there is a requirement to disclose “material damages,” read: financial damages. One of the best ways to mitigate financial damage? Insurance coverage.

With a steady increase in the number of cyber-specific rules and regulations hitting the industry, companies are preparing to proactively protect themselves financially and comply with pending policies.

Year-end conclusion: Regulation and cyber insurance will become intertwined in 2024; many cyber insurance companies are already requiring the implementation and use of monitoring and detection tools as a prerequisite for coverage. And many companies are having a hard time meeting these requirements. But as the market matures, and the cost of cyber crime increases, expect to see a co-mingling of these fields.

Exposure Management Overshadows Vulnerabilities

“Exposure management” and “proactive security” are starting to emanate from the primary industry analyst firms and, of course, that means it’s making its way into vendor marketing. But, even though it’s buzzy or hype-y, I think this one has some legs. Not the buzzword, just the concept.

Why? Because companies have been focused for a very long time on vulnerability management. And while vulnerability management is an absolutely necessary element of a security program, fixing vulnerabilities is an action a company must take to decrease its exposure to risk — risk of compromise, risk of data leak or loss, risk of system disruption, etc. And the main goal of a security program is — or should be — risk reduction. Whatever we do in cybersecurity, it should be in service of risk reduction. Not just cyber risk reduction, mind you, but business risk reduction. 

Before you can get to risk, though, you have to know your exposures, and those extend beyond vulnerabilities. 

Exposure management and proactive security aren’t new concepts. All that’s happening now is the creation of a term/category/buzzword.3 And while I am generally not a fan of creating buzzwords for invention’s sake, I think it’s a good idea to codify what the concept is so that security teams can wrap their heads around what needs to be done to reduce risk.

Year-end conclusion: “Exposure management” will be incorporated into nearly every cyber vendor’s marketing message. The analyst firms will publish documents about the importance of exposure management, and include top companies in those reports. Comparisons between disparate companies will confuse buyers into thinking “exposure management” is a tool that can be deployed rather than a foundational concept.

Now what?

Like last year, I’ve gone through a few serious topics in the above text. And, while I trend toward verbose, I want to wrap up this post with the insights of a few of my security friends who are much smarter and more interesting than I am. Enjoy their not-so-serious and/or serious-but-concerning predictions and trends for 2024. 

This is an end-of-year post. Have some fun with it! And maybe we’ll do this again twelve months from now.

Ben Rothke, Senior Information Security Manager, Experian

I predict all of the core information security problems and issues Cliff Stoll encountered in the late 1980s will occur in 2024.

Josh Marpet, CEO, MJM Growth

I predict that ransomware will mutate through natural selection and become “AnnoyingWare.” It will sing Christmas carols incessantly, and do it to a mariachi beat.

Chris Nickerson, Founder, LARES Consulting

I predict that the AI/Anti-AI movement will neutralize the hipster buzzword marketing movements of the 2024 mass adoption security technology index.

Tim Krabec, Principal Information Architect

Companies will complain about the 30 billion shortage of cybersecurity professionals but refuse to change job descriptions that increasingly insist applicants be “security unicorns” with 15+ years of experience and total mastery of every security vendor product deployed in the employer’s infrastructure.  

HR departments and recruiters will also continue to use AI to review job applicants, thereby forcing candidates that are better at buzzwords than technology onto security hiring managers.

Ira Winkler, Field CISO and Vice President, CYE

I predict that the crimes committed by security influencers will double. 

I predict that the organizations that predict cybercrime and skills shortage numbers will triple their predictions without any supporting data. 

I predict that nobody will go back and see how well the predictions did, allowing people with bad takes on cybersecurity to continue to influence the market next year. 

To that end, I predict cybersecurity industry predictions will grow by 2000% next year.

And last but not least, a prediction that is more scary than silly… 

Jennifer Minella, Founder and Principal Advisor, Network Security, Viszen Security

I predict the use of human user vulnerability “scanning,” analysis, and enumeration using AI/ML. This analysis will be based on users’ profiles and behavioral analytics, and will include inputs far beyond on-screen actions, such as inputs from all publicly accessible data points that don't violate privacy.

As a result, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) recently released a set of guidelines for secure development of AI-based products.

In this week’s article, I’ll look at why this guidance is necessary, and why companies developing or using AI must go beyond the current guidance. 

Since the public launch of ChatGPT a year (+) ago, the cybersecurity industry has been abuzz with talk about how artificial intelligence (AI) is going to be life-changing, industry-changing, and hugely revenue-generating. Everywhere you turn — in both your personal and professional life — you can’t escape proclamations about AI’s potential. Corporations big and small, across nearly every industry, are rushing toward an “AI-first” approach to business growth. This, naturally, raises questions about the risks of AI and how it will impact people’s lives and society in general.

On one side we have tech enthusiasts, individuals who have been awaiting the moment when AI becomes mature enough to incorporate…everywhere (eh hmm, Tyler). On the other side we have tech cautionaries. These may be people who don’t know the ins and outs of how AI (or LLMs or even machine learning) works and worry about “the robots taking over.”1  And then there are the people who know tech very well and are wary of the risks AI poses. For good reason, mind you.

Regardless of the risks (or known risks, perhaps), businesses are forging ahead. Cybersecurity vendors are some of the most eager to incorporate AI or AI-like capabilities into their products. Being on the forefront of technology, the majority of the industry has a thirst for new and promising capabilities, of which AI is certainly one. To support this thirst, funding for startups that use AI or claim to have a product to secure AI are the only startups still raking in impressive investments.

It is therefore no great surprise that rule- and law-makers are starting to issue guidance and propose legislation for the secure development and use of AI.2 The recent guidance issued by CISA and NCSC is the most notable (and possibly most thorough) to date. According to the published guidelines, the aim is to assist “providers of any systems that use artificial intelligence (AI), whether those systems have been created from scratch or built on top of tools and services provided by others.” The primary stated focus of the guidance is “providers of AI systems who are using models hosted by an organisation, or are using external application programming interfaces (APIs).”

The guidance, itself, is laid out in four sections meant to span the development lifecycle. They are:

1. Secure design

2. Secure development

3. Secure deployment

4. Secure operation and maintenance

You can read the entire document here.

Why do we need this guidance, and why now?

Perhaps in Utopia the world wouldn’t need such guidelines for the secure development and use of AI (or anything, really). Reality is, though, that humans need guardrails. Bad actors will always manipulate technology for malicious use, and even well-meaning users and builders will, on occasion, cut corners and unintentionally create vulnerabilities in efforts to save time, make money, or impact a wide variety of consequences. And the more powerful AI becomes, the more risk it carries with it.

This is why CISA and NCSC published this guidance now — before things are too far along. It is crucial that builders and users address AI-related risks and challenges now and create a precedent. It’s the concept of “baking security in” (versus “bolting it on”) that we’ve talked about in security for so long.

The fact is — and I discussed it with my co-hosts on Enterprise Security Weekly recently — that securing AI is not all that different from securing other types of technology, in particular, systems that collect, process, and store critical data. But “AI” is the new buzzword, and if we say, “just do what you do for other data…” you know there will be lapses in judgment and processes.3

Nonetheless, the CISA-NCSC guidance (which, if you haven’t had a chance to read closely, was “co-sealed by 23 domestic and international cybersecurity organizations”4) is significant for several key reasons:

1.  Data Privacy and Security: As I wrote above, if you truly break it down, “AI security” is simply data security — only at a much greater scale and speed. To iterate on why this is important: The new guidelines help ensure that the systems used to generate AI models and the sensitive data used in AI algorithms are secured with multi-layered controls which help protect individuals’ and organizations’ privacy. 

However, as this guidance is specific to AI development and use, the publication outlines steps for staff awareness of AI-specific threats and risks; the need for threat modeling; assessing the appropriateness of AI system design choices and training models; system monitoring, testing, and documentation; and incident management procedures, just to name a few important processes and procedures.

2. Robustness and Resilience: Adding on to the “secure by design” principles of the previous bullet, the guidelines state that AI systems and algorithms should be resilient to adversarial attacks and unexpected disruptions. The security principles outlined in the document help developers build resilient systems that can withstand many types of attempts at compromise.

3. Accountability and Transparency: The CISA-NCSC guidance asks AI providers to follow “secure by design” principles, a main element of which is embracing “radical transparency and accountability.” While AI providers might worry about exposing intellectual property, they must be forthright about their strategy for and execution of AI models so that individuals and organizations adversely affected by AI (whether that’s copyright infringement, unauthorized data disclosure, or a whole host of other nastiness) have some recourse in the event of a compromise. The guidance says that builders should “release models, applications, or systems only after subjecting them to appropriate and effective security evaluation such as benchmarking and red teaming” and that they “are clear to [your] users about known limitations or potential failure modes.” 

4. Ethical Considerations: The guidance helps providers assess the appropriateness of their design choices. Specifically, the publication calls out the need to continuously protect AI models, develop incident management procedures, and make it easy for users to “do the right things.” Because AI has the potential to so significantly alter society, builders and users of AI technologies mustn’t just ask, “can I,” but repeatedly question, “should I?”

5. Global Standards: Although CISA and the NCSC were the primary parties responsible for these AI guidelines, many international cybersecurity organizations cooperated on the effort. This type of global effort underscores the necessity for standardization — something missing for much other cybersecurity guidance — and fosters consistency and interoperability across different AI systems. 

6. Trust and Acceptance: One of the deepest concerns about AI is that it can’t be trusted to protect human interests. As such, the guidelines help providers and users think through how to build systems that are hardened to security threats, misuse, and abuse. Trust is essential for widespread acceptance and adoption of AI technologies, and these guidelines contribute to the establishment of trust and reliability.

7. Regulatory Compliance: You better bet that AI-specific regulatory compliance is coming. And likely soon. Data protection and data privacy laws already exist for numerous industries and geographies; AI protection laws will be similar and, perhaps, even more stringent. Companies that adhere to these guidelines will increase their preparedness for demonstrating compliance when the time comes, and (possibly even more importantly) have greater capability to defend against compromises that endanger individuals and organizations.

The wrap up

The joint guidance from CISA, the NCSC, and their partners is a big deal because it sets an early precedent. Too frequently in the past, technology innovators have not considered security and privacy implications (IoT, cloud, and mobile, I’m lookin’ at you), leaving security teams with the arduous task of playing catch-up. 

What’s more, those who “bake” these suggestions and principles into their AI tools will be better positioned (themselves or for their users) to mitigate risks, protect privacy, and foster trust among users and stakeholders. Because this guidance was formed on a global level, it should help standardize expectations and keep AI providers’ minimum viable on a level playing field.

This article will look at some of the recent ransomware news and explore what layers end users can add to their cyber arsenal to prevent ransomware from propagating.

Ransomware is a constant concern for businesses. According to AAG, more than 623 million ransomware attacks were detected or executed in 2021. Over the last five years, ransomware has increased by 13%. The 2023 Verizon Data Breach Investigations Report (DBIR) shows that ransomware persists as a top attack tactic, accounting for 24% of breaches globally, and is present in 15.5% of reported incidents. If this isn’t enough data to convince you, I don’t know what is.

What’s so concerning about ransomware is that a lot of businesses still think it’s a social engineering problem — just tell employees not to click on suspicious links or attachments and that will solve your problems. Unfortunately, no amount of employee awareness is going to save your company from ransomware (or any other exploit attempt, really). It is a fact of corporate life that links need to be clicked and attachments need to be opened. The vast majority are safe, and the malicious ones can be hard to spot.

Ransomware, like any other cyber attack type, requires a multi-layered approach, and one that starts with access control and zero trust policies. It seems simple enough, yet, in the last few weeks, we’ve seen a New York state hospital fined $450,000 USD for spotty security that resulted in a ransomware attack; the U.S. Treasury Secretary, Janet Yellen, admit that a ransomware attack on a bank in China “may” have “minimally” affected the Treasury market; Toyota Financial Services confirm systems in Europe and Africa were taken down by a ransomware attack; and both Boeing and Allen and Overy (an international law firm) get hit by Lockbit.1

In every one of the incidents listed, as well as almost every cyber attack in the history of cyber attacks, success wasn’t achieved by a single point of failure. An infiltration point is like the start of a scavenger hunt — there are many more steps that need to be taken to finish the activity. And ransomware gangs have both time and motivation on their side.2 Still there are steps that can be taken to both prevent ransomware infections and stop the progression of a compromise if a threat actor is able penetrate initial access.

1. Be vigilant with security software: We’ve heard “antivirus is dead” a thousand times in the last decade. But that couldn’t be farther from the truth. Antivirus and anti-malware are not silver bullets, but investing in these tools (and keeping them up to date) will help eliminate the so-called low-hanging fruit of easy access for attackers. 

2. Zone in on zero trust: You’ve heard it from me a zillion times, but a zero trust architecture will stop the progression of an attack, regardless of how it starts. Zero trust’s promise is to provide layered— and adaptive — protections, including: 

   1. Multi-factor authentication (MFA): MFA should be a standard authentication control for all users and all systems, especially critical systems or systems with sensitive and high-risk data.

   2. Advanced access control policies: Least privilege access rights and permissions are a must for users and systems. Allowing only a minimum level of access on your networks will reduce the damage from a successful exploit.  

   3. Segment, segment, segment: A wide open network is a big no-no. Implement controls to divide data and systems and conquer unauthorized lateral movement across your networks.

3. Make sure to monitor: Ensure that deployed network monitoring tools are sufficient for your (undoubtedly) sprawling infrastructure. It’s not useful to monitor only what’s on-prem if a ransomware gang can access your cloud environments and all the juicy data stored there. And vice versa. Assess the network security tools you have deployed (e.g., EDR,/MDR/NDR, endpoint controls, NTA, IP/DS, etc.), regularly check (and tune) policies, analyze the data, and use it to quickly identify and eradicate bad network behavior.

4. Fix that hole in the bucket, dear Liza3: Unpatched software and systems are a beacon to threat actors. Savvy criminals will take advantage of lapses in patching, especially when a known vulnerability has been hanging around. 

   Further, please encrypt your data. This is what ransomware gangs are after, after all, so take away the “prize.” The latest attack on identity provider Okta, is the reminder that, when important files are stored in the clear, they will be weaponized. 

5. When in doubt, back it up: Regularly backup your important data to an external drive or secure cloud service. If the worst happens, you won’t be held hostage for your own information and can recover quickly, decreasing downtime and reducing the cost of an incident. 

A layered defense is the key to preventing and dealing with ransomware. OK, maybe an attacker is able to steal an employee’s credentials. Sadly, it happens. The attack can be stopped with deployed MFA and strict access controls. OK, they manage to circumvent access. They are skilled and sneaky. If your files are encrypted, the attacker can’t know if they’re valuable, a decoy, or just gibberish.

Harden your systems at each layer to avoid costly and disruptive incidents. It’s unlikely that we’ll see a decline in ransomware over time, especially if security fundamentals continue to receive less love than the new-and-exciting tech making security headlines. Attend to your basics to best your attackers. Then go worry about that fancy, new zero day.

These terms pop up every few years and the cycle repeats itself. Buyers hate it. Media outlets make fun of it. Conference coordinators  publish the “most overused” buzzwords that appear on vendor booths. Heck, even the engineers at vendor companies scoff at it. Why, then, do we tolerate it? Why is there so much pressure in marketing circles to play along with buzzword bingo? And, most importantly, what can you do to avoid falling into the buzz-trap?

From time immemorial, businesses have had to try to differentiate themselves. If a business sounds too much like another company, buyers and would-be buyers are likely to be confused and/or unclear on why Company A is better than Company B or C or D.... Yet, associating with established terms and categories helps buyers understand what, exactly, they’re evaluating. It helps sellers form quick connections in their brains, and determine where an offering might fit into their strategy and budget. 

In the ever-evolving world of cybersecurity, we see new categories, topics, and classifications of products continuously emerge from marketing departments, industry analysts teams, and media outlets. When the term/topic/category is catchy, others want to adopt it and adapt it to their messaging. The more the term is used, the more others want to use it. Before you know it, every company and every piece of marketing collateral sounds alike. A buzzword is born.

Stage one

While at first blush it might seem like sheer sloppiness, there’s more to buzzword embracement than laziness or glaring attempts to steal market share via confusion tactics. Let's look at a common scenario: A company is first to market with a product or service in a “new” category. The product/service isn’t defined well by an existing term (at least in the developer’s estimation). The company therefore creates its own “new” category or term, or works with industry analysts and media to craft a term they feel more adequately conveys the item(s) for sale.

If that product or service is at all viable, we’ll start to see similar offerings come to market. While on the surface this could appear to be copycat product development, what’s usually happening is a confluence of events (in IT, cybersecurity, or the attacker landscape) that lead innovators to want to fill a gap in the tools marketplace—to want to invent new capabilities that allow them to overcome a common, current-state problem. Innovation generally follows market need, and when it comes to new products and evolved functionality, related ideas have probably been percolating in the minds of many for some time.  

This is why, when a “new” technology hits the market, it feels like a landslide—a “sudden” explosive growth of this “new” category. 

Stage two

Markets then become crowded and buyers have a plethora of choices. Sellers start to think: If the words used to describe the first product or tool out of the gate is resonating throughout the industry, why shouldn’t my business use that term? If industry analysts or cybersecurity media are also promoting this new buzzword, chances are vendors are going to want in. To gain recognition, businesses have to be using the right terms; buyers don’t want to have to work overly hard to differentiate and disambiguate product companies’ marketing messages. Buyers don’t necessarily care what the term is. They simply want the functionality promised so they can identify, detect, or respond to new threats more quickly; to prioritize work; to be more efficient and accurate; to drive down and/or communicate risk; to pass audits; and so on.

Yet, buyers get caught between the vendor landscape and industry pundits (i.e., analysts, media, anyone with a blog or social media account). The more end users who start using the new term—either because they can’t avoid it or they need it to sell the idea internally—the more likely it is that the term/topic/category becomes ubiquitous. And buzz-worthy.

Stage three

With that ubiquity comes search engine optimization, or “SEO.” Marketing teams have to ensure that search engines are including their company and its offerings in results. It would be a virtual kiss of death for buyers to not be able to find a company in an appropriate category. So once the search providers start including a buzzword in their results, it’s almost impossible for vendors to not use them. Marketing teams feel pressured to insert the top-ranking SEO terms in their website copy, in digital collateral, and on social media. Right, social media. Can’t forget to use the hashtags associated with these new terms.

Acceptance

You can see how quickly terms/topics/categories turn into buzzwords. Someone (or a business) introduces a term. Everyone starts using it. Vendors start skewing it to fit their product or service (to tackle the first problem listed in this article: the need for differentiation). Buyers get confused. The market largely makes fun of it. What the market is left with is a whole bunch of companies vying for air time by using a buzzword (or sometimes even a “buzz-phrase”) that people are searching for or writing about. 

The big question is: What can cybersecurity vendors do about this? How can they avoid being the next buzzword-laden company? Dare I say it’s nearly impossible to avoid? That’s depressing. But yet, it’s largely true. As anyone who is responsible for messaging, media and analyst relations, public relations, corporate fundraising, or sales at a vendor firm knows, it’s helpful to align with common industry terms. One of those reasons is that cybersecurity buyers have “line items” allocated in their budget for certain categories of tools. If that category is currently dominating the media, if a non-tech executive has colleagues talking about that category and how it has seemingly reduced risk or prevented a breach, or if a public breach sends a board member into a panic, that category is more likely to be approved for procurement than a tool in an obscure or old-school category.

However, companies still have to differentiate—from real competition and from businesses that have appropriated buzzwords to attract greater market share. If you’re in this situation, how do you avoid becoming the next chip on the buzzword bingo card?

Rely on data: Marketing should be about data instead of catchy phrases and buzzwords. While buzzwords are hard to avoid for the aforementioned reasons, marketing and messaging teams must look at the data behind marketing efforts. Analyze the terms that are bringing in the greatest numbers of website traffic, conversations, and leads (hint: they might not be the buzzword at all). Look at the sources of the leads and learn the demographics behind them.

Understand your audience: Speaking of demographics, before slapping buzzwords all over every piece of collateral, research and define your target audience. Go directly to the market to gather data on buyers and their needs, their workflows, their habits, their likes and dislikes. Take that data and turn it into personas. Put in the work to understand buyer personas before you go to market with messaging so you can build messaging that resonates. Even if you do need to incorporate buzzwords to stay search-, analyst-, or media-friendly, if you understand your buyer, your messaging doesn’t have to be all about buzzwords and you can more easily differentiate. 

Address a market need: It’s fine to incorporate the dreaded buzzwords if you need to, but ensure that you’re accompanying them with descriptions of a real market need. Use plain language to describe what problems your product or service solves. Clearly and concisely explain the benefits it provides. Be careful not to conflate features and functionality with benefits. Benefits are business related, pain related, ease-of-use related. 

Adapt: While standing out in a crowded market is a major challenge, no one knows better than cybersecurity professionals that change is constant. What works messaging-wise today may not work tomorrow. A term that’s popular today might be out of fashion in a year. The security landscape (and the products in it) will shift. More buzzwords will emerge and go through the same cycle. This means that effective marketing teams will continuously measure and adapt messaging, irrespective of the biggest marketing buzzword. For instance, firewalls were created in the late 1980s. What companies use to protect their network today may have progressed technologically since then, but firewalls are still an important element of every cybersecurity program. Don’t discard a term/categorization just because it’s no longer de rigeur.

Evolve: Accept that marketing isn’t about “winning” and therefore not entirely dependent on buzzword alignment. Wait? What?? It’s totally about winning, Katie!! Yes, it’s the marketing team’s charge to help grow market share, and communicating the right words are a big part of that. Ultimately, though, if you sprinkle the buzzwords onto the places that require a touch of seasoning but largely focus on needs and use cases, you will build market share without the risk of dumbing down your marketing efforts, confusing buyers, or inadvertently pitting your business against vendors who don’t even do what you do…except use the same buzzwords.

Many cybersecurity companies are founded because a security professional was lacking a tool or tools that could have improved their work. Many times, a person — or small group — uses this as the impetus to start a side project and see if they can build the technology they want. In time, and with enough of a foundation, the decision is made to leave gainful employment behind and become a self-sufficient founder — to see if the product or service can make it on the commercial market. The safety net is gone. The stakes are high. This is more than just a job.

Entrepreneurship should be lauded — it’s absolutely necessary to advance security and society. But it is not a decision to be made lightly. And there is no guarantee of success, especially financial success. At least, not the kind of multi-million dollar exit success I hear would-be founders batting around at times.    

In the first part of this topic, I explored market conditions and the commitment required to start a business. In this second segment, I’ll outline just a few of the steps founders have to take if they want to go from ideation to (profitable) exit.

Preparing for an IPO or acquisition

Those up for the challenge of founding a company must do extensive homework. “Build it and they will come” is not a thing in cybersecurity. A company/team can build the greatest, most advantageous product on the market, but without a strategy, solid business plan, advisors, funding, proper documentation, corporate governance, strong sales and marketing teams, press and industry relationships, and on and on, market success is unlikely.

To take a company public in the U.S., also known as an initial public offering (IPO), the executive team must:

• Evaluate readiness and objectives: Has the company built a salable product? Has the company reached financial stability and have a steady growth rate? Is a future roadmap in place and technically viable? How will going public help with future operations? What is the long-term strategy?

• Enlist advisors: These experienced individuals will be the “IPO Team.” Arguably, any company that hopes to have a successful future will have cemented relationships with advisors and board members long before any exit is planned. But if the company doesn’t have a team of advisors in place already, now is the time to start engaging with product, financial, and legal advisors.

• Prepare finances: Work with finance experts to ensure financial statements are in order, properly audited, and comply with generally accepted accounting principles (GAAP). The finance team (internal and external) can also help establish rigorous financial processes and controls that will help facilitate meeting regulatory requirements, and ensure that all financial reporting is factual and up to date.

• Select underwriters: Choose the financial institutions that will be the underwriters for the IPO. This selection should optimally happen alongside choosing company advisors, as underwriters will help with financial readiness throughout the process.

• Secure regulatory approvals: Needless to say, companies need to obtain numerous regulatory approvals before going public, including those from the SEC and state regulators.

• Select stock exchange: Choose the exchanges on which the company will be listed (e.g., NYSE, NASDAQ). Each exchange has its own set of prerequisites for an IPO.

• Register with the SEC: File a registration with the U.S. Securities and Exchange Commission (SEC). The SEC will review the registration statement. Beware: it might be a lengthy process that involves multiple rounds and revisions.

• Set the price: Determine the initial offering price for the company’s shares based on market conditions and demand.

• Determine a communications plan: Communicate openly and honestly to all stakeholders. Different levels of communication are appropriate for different stakeholders, so work closely with marketing, communications, press, legal, and human resources teams to decide on the right strategy.

• Schedule a roadshow: Just like selling a product or service to potential users, companies on the verge of IPO will need to prepare and execute meetings with investors to generate interest and belief in the company and its offering(s).

The above is just a sampling of what’s to come. There are many more steps, approvals, and documents that must be prepared along the way.

Acquisitions are similar to an IPO in that they require careful consideration, due diligence, and preparation. Many of the above steps apply to acquisition planning. However, there are some key differences:

• Employees: Often, an acquisition involves employee restructuring whereas an IPO will not (at least not initially). Executive teams must develop a plan to communicate the acquisition and its impacts to employees.

• Partners, contractors, and suppliers: These stakeholders, too, will need to see and hear transparent and timely communications.

• Integration: Acquisitions involve the joining of forces between two companies. This means not only the products or services, but the above mentioned stakeholders as well as the technology estate. The executive team and its advisors must prepare a thorough integration plan that covers how all people and system integration will happen.

• Customers: Customers are the reason the company can even begin to think about an acquisition (or IPO in the first place). Messaging to customers — from companies on both sides of the acquisition —including how customer relationships will be handled and/or transitioned is of primary importance. 

The wrap up

Although the idea of taking a company from zero to a life-altering financial windfall is enticing, even the cursory description of what goes into starting a company and getting it up and running should make a person think seriously. It won’t be easy to get things going — and “going” is just the beginning.

Setting your sights on a highly successful business — one that is profitable; one that can grow its products and services; one that is highly regarded by prospects, customers, analysts, and funding sources; one that attracts and retains diligent employees — is even harder. Some lucky individuals will end up flush with cash at the end of their endeavor. Many will get a good-but-not-startling return on their endeavor. Others, still, will break even or end up with financial debt. 

It is advisable, therefore, to approach startup life as a life-changing endeavor in and of itself. Financial success (if it’s achievable) will be the cherry on top. While it’s in no way wrong to want a secure — or even cushy — financial future, every startup is a gamble and a big bank account is not guaranteed. As the saying goes, “focus on the journey, not the destination.” Because even the hardest and smartest of workers might find that “success” is entirely separate from a seven (plus) figure bank account. 

In this two-part article, we'll look at why founding a company for a big payout is a bad idea, and what to do if you're running a company that is ready for the next step.

There is no doubt that cybersecurity is a lucrative field, and one that is primed for innovation. Due to our ever-increasing reliance on technology, companies’ digital attack surfaces are constantly expanding, necessitating the development of new and better-equipped security products and services. These factors, combined, are the lure for many talented technology-focused professionals to want to join the field. And in certain cases — given the right conditions  — some try their hand at starting a company.  

Many a cybersecurity vendor company has been founded by a frustrated tech or security worker who wished they had a specific tool to help them accomplish their work with greater ease and accuracy. As a former analyst, I can’t count the number of times vendor briefings started with some form of, “When I was working as a cybersecurity analyst/engineer/operator, I wasn’t able to accomplish [X] with the tools I had at my disposal. I went looking for it in the commercial market, but nothing did what I needed it to do.  I started my own company to build [X] and solve the problem of [Y]” 

In my mind, a gap in the market is a good reason to build a product and a company. That is, as long as others agree there is a gap that needs to be filled. As the proverb goes: Necessity is the Mother of Invention. 

However, with the security industry growing at such a rapid pace, and the money that continues to flow into the field despite an economic downturn, some enterprising technologists have fast tracked their product idea into a quest for the life-changing sums of money that have resulted from acquisitions and/or IPOs. In these instances, the goal is the exit, not the creation of a great product or service.

Growth of the cybersecurity market

Anyone who has been in security for a few moments has watched its astronomical growth. Let’s go back just a decade or so  — and that’s not even close to the beginning. In 2012, the global security market was valued at $61.8 billion USD. At the close of 2022, the market was valued at $153.65 billion USD and is projected to reach $172.32 billion by the end of 2023. So we know market demand exists.

Looking at the acquisitions market, SecurityWeek reported that 455 cybersecurity M&A deals were announced in 2022. Of those deals, only 62 announcements included financial details, but the total transaction amount for those disclosed deals equaled $63 billion USD. Yes, your math is right. That’s mind blowing. Not to mention tempting for anyone who thinks their big idea will be a big hit with end users or a bigger company looking to expand its product portfolio. Entrepreneurs and would-be entrepreneurs who have big bucks on the brain need only reference acquisitions like Sailpoint (~$6.9b), Datto ($6.2b), Mandiant ($5.4b), any many other “unicorn” deals. 

As for initial public offerings (IPOs), the last year or so has been rough on all types of companies. But if we go back just two years, you’ll see that cybersecurity companies that were able to complete an IPO did very well for themselves. 

Seeking cybersecurity innovation

Without a doubt, cybersecurity needs innovation. What it needs most is new methods and tools that are effective and efficient against cyber attack, unauthorized access, and data leaks. The betterment of the industry should be the real goal. Exit money that accompanies a valuable product or service should be the cherry on top. 

Yet, we live in a capitalist society, and there's nothing wrong with striving for financial success while developing a product or services that benefits cyber defenders. The problems arise when the goal is financial success instead of a good product. We have and will continue to see companies founded for financial gain. Some of them will be commercial hits; others will die before they secure a seed round.

Because the security of organizations’ infrastructures is critical to daily life, it is my personal opinion that technological advancement should be the primary purpose behind innovation. Monetary gain should be a result of a good product or service. It is easy to think, “If a product/service is valuable, it will therefore be a commercial success.” But we all know that isn’t that case. Many good ideas never take off — or take off years after they were first introduced to the market. And many bad ideas sell well because they’re wrapped in shiny packages, because certain investors back them1, because some analyst or conference declares the company or category the next industry-saving innovation…

Starting a company and building the products and services it sells is hard work. While money doesn’t always follow success, founders who build a company focused on an exit are doing a great disservice to the industry — they’re selling a false promise. They may also end up harming thousands or millions of people, if they’re not careful.  

Not to mention, talk to any cybersecurity founder about their journey and you’ll hear the same thing: Founding a company isn’t for the faint of heart. Your life will be disrupted for years. Your personal finances may be impacted. Your personal relationships surely will. Everything takes a backseat to the business. If that isn’t reason enough to go in with altruistic goals, I don’t know what is. 

And fortunately, some innovators will take their turn at starting a company because they want to change cybersecurity for the better. They want to help the good guys. They want to stop the bad ones. They will pour their blood, sweat, and tears into their companies because they want to make a difference. Some of them will end up very, very rich. The good ones should.  

The wrap up

While it might be tempting to dream of a future where a great idea turns into a financial windfall, this is not an easy path — nor is it guaranteed. Many honest efforts by talented founders have resulted in company closures or acquihires instead of the coveted cyber fame and fortune.

In the next article I’ll detail some of the steps founders need to take to get from the proverbial “two-founders-in-a-garage” to a successful IPO or acquisition. Given the amount of work required, any entrepreneur with dollar signs in their eyes might want to pause and decide if the risk is worth taking. 

"Success is no accident. It is hard work, perseverance, learning, studying, sacrifice and most of all, love of what you are doing or learning to do." — Pelé, Brazilian soccer player

"I’m a great believer in luck, and I find the harder I work the more I have of it." — Thomas Jefferson, American Founding Father

Have you ever heard the above and similar statements? During my entire childhood, I was trained to believe that hard work, coupled with continuous learning and perseverance, were the keys to success. Of course, being “smart” and staying in school were also concepts drilled into my brain.

I have always been proud of how hard I work — not just at my day job, but for the relationships that matter to me, the hobbies I choose to pursue, and for my own personal growth and betterment. To me, it feels good to work hard and accomplish things. I’ve also embraced the “work smarter, not harder” approach, but the two are, at least in my mind, linked. And I think a lot of people agree with me. If, at the end of the day, a person can feel like they made a contribution to…something…if the feeling of success comes from the blood, sweat, and tears they put into a job/task/activity, that’s positive. That’s “right.” 

Over the years, I’ve been very fortunate to have met and gotten to work with a number of like-minded, hard-working cybersecurity professionals — people who put in long days and go the extra mile all the time. A number of them have seen great success in their careers, earning recognition and accolades for their dedication. 

Coexisting alongside them are the seeming  “rock stars” of cyber. These industry icons attract groupies who follow every social media account and like or comment on every post. They pack rooms at conferences regardless of the topic they present. Their blogs and podcasts are heralded in “best of” lists and they’re named “someone to watch.” Maybe these people work hard. Maybe they don’t. Sometimes these individuals have made great contributions to science and technology, but oftentimes they have not. They say things others have said before them, but for some reason, when they say it, it turns into the “gospel.” They borrow themes and concepts that catch on, even if the theme or concept has been batted around for years. They make bold claims without any data to back them up. They are, for lack of a better term, cybersecurity influencers.

“Rock star” versus “rock solid”

For years, I have wondered what makes certain people influencers while others with similar skills and talents, yet with more dedication and stronger work ethics, never seem to achieve industry acclaim. Of course there are people who don’t want that kind of recognition — plenty of folks want to simply sit behind a computer, contribute to the field, but mostly want to be left alone to execute their job well. 

On the flip side, influencers thrive on attention (and sometimes the pay bump that results from being heard). The quality of their work is of lesser importance (though they’d argue the contrary to their death). At times, influencers will say or do things just to see if it ignites a fire — whether they believe in the claim or not. I experienced this all the time when I was in charge of conference programming. And I felt compelled to add some of these people to agendas because they increased attendance, even if their talks were bound to be fluff or if they were saying the same thing they’d been saying for years, no new concepts or research.

On a conference level, this balance is OK. But when it comes to career success — promotions, equal pay, invitations for speaking engagements or media contributions, and the like — the idea that influencers are offered more opportunities and get greater credit for their work irks me to no end. Especially when we’re talking about the “influencers” who aren’t as hard working or dedicated to their craft as others who choose to keep their heads down.

This is why I derailed a conversation on Enterprise Security Weekly with my co-hosts, Adrian Sanabria and Tyler Shields. In case you aren’t familiar, both Adrian and Tyler are hard-working, smart, and thoughtful people. They are two of the people in the industry I look up to and turn to for advice, a second opinion, a sanity check, or a proofread. And both have achieved actual career success as well as a certain amount of “influencer” status. So I wanted to get their takes on why this happens.

What makes an influencer an influencer

Tyler, being a little more cynical like me, pointed to entertainment value — when a person possesses the ability to entertain, whether it’s mindless entertainment or thought-provoking entertainment, that’s when audiences gather. The entertainment value can be absurd and empty, like watching the Kardashians or slowing down to peek at a car crash on the side of the highway (wait, are those things synonymous?). 

It could be about high energy — watching a speaker on stage who knows how to use their body language and tone of voice to amp up the room — kind of like Pitbull. For the record, I like Pitbull’s music, but it’s mostly ripoffs of other tunes with a great beat layered on top. His concerts feature flashing lights and scantily-clad dancers. Whipped cream — not much substance, but it makes you feel good.

And then there are the people who just speak the loudest — people who like to stir up trouble, maybe through disinformation or conspiracy theories, just to watch the impact. They know that “fake news” spreads farther and faster than facts. For them, they are both the entertainment and a recipient of entertainment, at others’ expense.

There are plenty of types of entertainment, and that’s how a number of “cybersecurity rock stars” become “rock stars.” Tyler’s explanation resonates, even if some of these people are solely entertainment. 

Adrian, on the other hand, said that people follow cyber “influencers” who they feel are genuine and dedicated, people who are constantly learning, growing, and helping the industry in some demonstrable way. Sorry, Adrian, that’s you. 

But, I agree with Adrian that influencers can be all those things. They should be if their aim is for positive professional and personal progress. The genuine, hard-working people who get recognition because of the work they do for the industry, in my opinion, deserve recognition and opportunities. 

However, the people described in the last two paragraphs aren’t the ones who confound me, the people who, when their posts show up on social media, I scroll by because I feel the majority of their aim is self aggrandizement. Those people, the ones who revel in their own “influence,” overshadow quieter, less outwardly effusive people. And, despite the quality of their work output, the attention seekers are the individuals who are offered center stage a lot more frequently.

Unfortunately, this hurts the industry more than it helps. It brings us no closer to closing cybersecurity gaps and stopping bad guys. It rewards the wrong things. 

Influence and achievement

When it comes to career success — getting a new job, promotion, or salary increase — the influencers seem to have the upper hand. When it comes to getting help, again, people will rush to influencers’ sides, whereas more reserved people have to ask more people, more times, and may or may not benefit from community in the same way. 

To illustrate, two acquaintances recently lost their jobs due to restructuring. One is someone who has been featured in the media as being “the best in the industry.” Don’t get me wrong, this person is a perfectly fine human and decent worker. I’ve just never seen them work particularly hard or do or say anything particularly innovative. On the other hand, they are über friendly and say nice things to people. Relying on their reputation and industry connections, they landed a new job in two weeks.

The other acquaintance is someone who constantly pushes themselves to be better, smarter, and more effective. Despite this, this person has, several times in the past, gotten dinged by bosses and coworkers as being “disruptive”  and “too direct” because they want to improve processes and outcomes. This person truly cares about doing a good job and helping others. But they are a somewhat-outcast because of their commitment to continuous improvement. They aren’t as conventionally friendly as the other person, but this person’s work is reliably strong. It took this person more than five months to find a job, because they didn’t have the status and connections to make the process easier.

Does it pay to be popular?

There is unequivocal evidence that people who are able to influence — via whatever means — are more likely to achieve greater career success. Hard work aside, savvy seems to be a key contributor to individual accomplishment. Can a person get away with a weaker work ethic or mediocre deliverables if they are entertaining, louder, friendlier?

Most people would publicly say “no.” No one wants to be caught praising a Kardashian over someone with a killer work ethic. But in reality, do we promote people who manage to sound convincing (and sometimes don’t stop making sounds) and then reward them unfairly? Do we tend to overlook people who can’t play the popularity game well? When this happens, how much does it hinder cybersecurity progress?

It’s an interesting topic that I’ve read about often. But today I am most interested in the industry’s opinion: When you identify industry influencers, are they substantive or just outspoken? What have you learned from them? Have you felt limited in your career because you prefer to avoid the limelight or simply don’t possess the power or desire to stand out? Have you seen people get passed over because they can’t compete with rock stars? 

And, what personal characteristics does it take to be a cyber “rock star”? Can these traits/characteristics be learned? Is it something you would do to get ahead? And, last but not least, is this something we should be aspiring to in security?

Only a few years in existence, and after a somewhat rocky start due to inappropriate political meddling, the agency has been highly prolific with its publications and guidance. One of the newer pieces coming from CISA is its offer to assist water sector companies with vulnerability identification. Per CISA’s data sheet about the new program, water utility companies can receive free external vulnerability scanning-as-a-service to “assess the health of [your] internet-accessible assets by checking for known vulnerabilities, weak configurations—or configuration errors—and suboptimal security practices.”

Any water utility that signs up for the free service will receive automated scans of their internet-exposed assets (as determined by decision makers at the utility) and weekly reporting. The reports will include a criticality rating for identified vulnerabilities and guidance for mitigating found vulnerabilities. Further, CISA will perform re-scans of the specified environment based on initial scanning results.

By any measure, vulnerability identification and quantification is a necessary part of risk management — which is why vulnerability scanning has been a foundational element of business’ cybersecurity programs for years. In the case of utility companies, which may not employ a plethora of cybersecurity experts and/or which may be grappling with IT/OT/digital transformation issues, any free service (provided by a reputable vendor or tool) that surfaces vulnerabilities is a positive step in closing control gaps that leave critical systems exposed to attack. Without an understanding of these exposures, no organization can expect to manage their networks and prevent or detect threats. Visibility is the first step, and that’s what CISA is offering.

An incomplete picture

Without a doubt, vulnerability assessments are one crucial step in achieving effective threat and risk management. But here’s where things get a little murky — for the CISA program and with vulnerability assessment tools in general: Vulnerability scanning, on its own, is an incomplete picture of an organization’s threat environment.  For one thing, scanning identifies only assets in scope and that are operational at the time of the scan. For the CISA program, the utility company (i.e., the “customer” or recipient of the scan) defines the scope of the scans, which requires an understanding of the network and the assets on it. Smaller, less-mature water utilities may not have that in-house expertise. So the starting point might be built on shaky ground.

Further, while the utility company can likely increase the scope of CISA’s scanning at any time, doing so still requires knowledge that a resource-strapped organization might not have. The CISA program (at least at this stage) does not provide guidance on how or where to increase scope.

Blind spots

Adding another layer of challenge: Scanning, by its very nature, isn’t continuous; it would consume too much compute power and likely result in system latency (perhaps on critical systems which could disrupt or disable them). Because of the intervallic nature of vulnerability scanning, “blackout periods,” during which threat actors could execute damage, may occur. Not to mention, unless multiple types of scanning are conducted (e.g., network, application, etc.), the utility won’t have a complete view of its vulnerabilities. CISA provides a timetable for scanning frequency, which is based on the criticality of found vulnerabilities. But a savvy cyber criminal could find ways around the schedule. Defenders aren't the only ones using scanning to determine efficacy, after all.

Alert fatigue

Speaking of identified vulnerabilities: even decently resourced security and IT teams at private organizations are used to the information overload and barrage of false positives that can result from activities like vulnerability scanning. The same might not be true of smaller, resource-strapped utility companies that may not even employ a full-time security professional. Triaging alerts, even if CISA is providing “detailed findings in consumable format to stakeholders,” could be crippling to an organization without a relatively mature security program established. 

Acting on the vulnerability mitigation recommendations supplied by CISA after the scans could be impossible for these organizations if they don’t have external help.

Lack of prioritization

If a water utility is able to effectively triage alerts, the next issue with which to contend is prioritization. While CISA provides plenty of guidance on vulnerability management and risk prioritization, including its Stakeholder-Specific Vulnerability Categorization (SSVC) methodology, every cyber remediation plan and process requires an individual assessment of the organization’s environment, risk tolerance, business goals, operational requirements, customer needs, technical capabilities, and so on. Again, for smaller, under-resourced utility companies and those without in-house security expertise, that decision process may be unattainable. 

And if the utility can’t prioritize remediation, all the scan data provided by CISA will go into a black hole; it will become a long list of items for someone to attend to, sometime in the future, when resources allow.   

All gloom and doom?

OK, OK — maybe this week, I am absorbing some of the gloom and doom that comes from working in the security industry for too long. And I don’t mean to be a Negative Nelly. In fact, I love what CISA is doing overall. As stated at the beginning of this article, CISA has done a lot of good things in a very short time, especially given the economic and political headwinds of the past few years. And, because of the state of most utility companies’ digital infrastructures, guidance and assistance must start at a foundational level. (I posit that every company needs to routinely revisit their security foundations to ensure the rest of the program isn’t built upon faulty footings. Most major breaches can be attributed to cracks in foundational controls. This is as true for private, mature, and well-resourced companies that aren’t contending with quite as much legacy infrastructure as water plants.)

Still, even though free scanning services for water companies is a step in the right direction, it’s just one step. More layers must be added as organizations start to see what they’re contending with. Information without action will leave these organizations exposed — and threat actors know it. 

Therefore, it’s my suggestion that water utilities (and anyone else reading about this service) take CISA’s vulnerability scanning guidance and approach as one piece of a very large puzzle. Putting it into a greater context, and bolstering it with complementary processes and techniques, is the only way to ward off more threats.

In cybersecurity, specifically, the need for additional headcount rarely wanes — current estimates put the global staffing shortfall at 3.4 million people. As a result, the “back to business” post-summer refocus is especially important, considering companies can never seem to hire security staff fast enough.

To supercharge cybersecurity hiring efforts, companies must think beyond basic job board postings and traditional recruitment efforts. Below we’ll look at three ways security teams can identify and attract new candidates for open positions, even if those methods deviate from the most obvious path.

Released earlier this year, the Fortinet 2023 Cybersecurity Skills Gap Global Research Report details the level of concern IT and security professionals have about the cybersecurity talent shortage. According to the findings, “68% of organizations indicate they face additional [cyber] risks because of cybersecurity skills shortages.” Further, the report says that 56% of respondents struggle to recruit security employees and 54% say turnover in the security department is a problem. 

Fortinet’s findings are in line with those of other organizations that have sought to quantify the state of the security talent pool. TL;DR — security teams need staff. There are not enough skilled workers in the current workforce to fill these in-demand positions. And while many articles about the issues abound, security teams, led by human resources departments and traditional recruiting firms, continue to try to find and attract talent via conventional methods. 

One quick look at job boards on LinkedIn, Indeed, and the like indicate that hiring teams are searching for cybersecurity employees with X number of years of experience, X type of cybersecurity/computer science/engineering degree, and X number of specialized certifications. In fact, the Fortinet report shows that “90% of leaders prefer to hire people with technology-focused certifications,” which is an increase of 9% since 2021. Yet, if you talk to a lot of cybersecurity practitioners, even ones focused on cybersecurity education, industry sentiment is that certifications don’t necessarily equal skill or mastery. It seems, then, that despite the growing gap between open positions and bodies to fill those positions, hiring managers and their supporting teams aren’t going the extra mile to find, attract, and retain additional security staff.

In the current hyper-competitive hiring market, scores of security teams struggle to fill open positions. Attracting top talent requires top dollar, strong benefits, and flexible working conditions. Yet, even for the best resourced companies, that isn’t enough; there are still too many spots sitting vacant. What, then, do cybersecurity employers need to do?

Be creative

In the past, I’ve written and talked about creativity in the hiring process. This concept is not exclusive to cybersecurity. My colleague Tonya Montella works with women (in all fields) who are looking to transition out of their current career paths into new roles. Tonya advises job seekers on how to position their acquired skills and experience for an entirely different role and responsibilities. For job seekers, the key is highlighting transferable skills, and making those skills map to the desired job.

Hirers can employ the same tactic: identify transferable skills in would-be employees and actively seek individuals with those traits. The subheading of this section is “Be creative,” and, unironically, creativity is a top trait identified by hiring managers in their best security staff. By nature, security professionals are inquisitive and always looking for new ways to tackle problems — hence the title of “hacker.” People with a creative mindset can be trained for technical careers, whereas it’s much harder to train someone who is not naturally creative to be creative.

Other transferable traits include advanced problem-solving skills, inquisitiveness, keen attention to detail, and a hungry appetite for knowledge acquisition. Of course, it doesn’t hurt to pursue individuals with high technical acumen, but remember that technology can be taught much more easily than inherent personality traits. While not all positions can be filled by people who want to become security experts but who aren’t yet, it’s likely that more roles than you think can be filled by ambitious job seekers. Individuals with IT backgrounds will ramp up much more easily for technical roles. However, those wanting to enter the field can fill entry-level positions while more-experienced and tech-savvy individuals can be up-leveled for senior positions.

Which brings us to #2.

Provide training and education

Learning and skill building resources are more abundantly available today than ever before. Between online training and in-person events, a wanna-be security practitioner or current practitioner wanting to enhance their knowledge and techniques could take some form of training practically every day of the year! For cyber students who prefer the self-taught method, a quick online search will yield more cybersecurity how-to books than anyone could possibly read.

However, the cost for training — especially if certificates are involved — and knowledge acquisition can be prohibitive. Offering learning opportunities to current and prospective employees is an attractive benefit, and one that will ultimately benefit both employers and employees.

Piling on the justification for company-provided training, hiring managers commonly lament that job applicants don’t have the hands-on experience required to perform job duties adequately. Positions that sit open for longer than necessary cost the company in many ways (including increased cyber risk) and frustrate both managers and staff, who are overwhelmed and overburdened. 

Though in tough economic times it might be a battle to secure funding for employee education and training, it is absolutely necessary. Not only can organizations train people into open positions, but research shows that employees who are given the opportunity to build their skills are happier, more productive, and stay longer at their jobs than those who feel stagnant. 

Many studies show that the cost to train or up-skill an employee is significantly less than the sunk costs of finding and onboarding new employees. In the case of cybersecurity jobs, many organizations will need to do both: provide training opportunities for current employees and train job transitioners into available roles. But the evidence is clear: ongoing training and skill building benefits everyone and makes companies standout in a competitive market.

Work with recruiters

This final suggestion is a tricky one to navigate. Recruiters are paid to fill positions on behalf of the hiring organization. The quicker a candidate is identified, the sooner recruiters can move on to the next open role and make more money. It is therefore advantageous for recruiters to seek out “the best matches,” i.e., candidates with all the right keywords on their resumes, and feed them to the hiring organization, while tossing out candidates that are looking to transition into a new career.

From personal experience, I can say this has happened to me more than once. From a job seeker point of view, it’s demeaning and demoralizing. From a hiring company perspective, it’s self-destructive. 

There is no one right path to finding great employees. And employees who are ambitious, creative, and fast learners may just become your next best employee, whether or not they currently have all the boxes checked. 

Find and work with recruiters who specialize in job transitions or cybersecurity specialist recruiters who understand that cybersecurity is about more than “hands on keyboards.” Recruiting firms like CyberSN, Cyber 360, and Redbud focus squarely on cybersecurity placement and understand the industry intimately. A massive part of their job is networking, meaning, they have resources they can tap on clients’ behalf to make the hiring process easier. 

The wrap up

There is no quick fix to hiring. Effective and productive cybersecurity employees come from many backgrounds and hold diverse skill sets. It is therefore incumbent upon companies to extend their narrow definition of hiring and recruiting in order to be successful. Firms that claim, “There aren’t any good candidates with the right experience,” are likely being too strict and limiting their own growth. By being open to a more inclusive view of what constitutes “cybersecurity staff,” companies will find more potential candidates to fill open roles, help train job seekers on the skills that will benefit the company long-term, create a happier work environment, and retain productive employees who will help the company achieve cyber success.