Builder of security products and programs. Teacher of those who run them. Cybersecurity executive, SANS Faculty Fellow, and creator of REMnux.
In the young security-for-AI market, what a product protects and how it ships can differ from what its label promises. With five questions drawn from the AI Defense Matrix Catalog work, you'll know what you're buying, whether that's a capability you already own or an early startup worth a closer look.
The market for products that secure AI is crowded and hard to read, with overlapping categories and products that each do many jobs. With the AI Defense Matrix, you can ask the right questions, tell what a product was built for, and staff the gaps no product fills yet.
Judging a security vendor from its own materials tells you little about how it compares to the rest. Cyber Company Profiles scores hundreds of cybersecurity companies from public sources.
The security-for-AI market is young and lopsided. Incumbents quickly extended their products into the AI versions of assets they already secured, while the more distinct AI assets drew startups and incumbents alike into markets that stay active and contested.
Answer ten questions about how your organization secures AI, and you get a peer benchmark in return. Sounil Yu and I will publish findings on which AI assets peers protect, who decides, and where controls come from.
A malware report is only as useful as readers' ability to find in it what they need. This customizable template organizes the findings into a coherent structure, so a responder, a manager, or a fellow researcher can benefit from the analysis.
In an effective executive brief, you lead with the bottom line and what a finding means for your organization. Use these four customizable templates to do exactly that across threat intel, vulnerabilities, incidents, and assessments.
When a high-profile vulnerability surfaces, executives and customers want to know whether it affects you. With a one-page brief and a short process, you can capture the key details and reach the answer without scrambling.
Every dev tool you grant API access to, AI assistants included, can read the keys within its reach. No setup removes that risk entirely, so the goal is fewer secrets exposed and less damage when one leaks.
Keyboard apps offer better predictions, voice transcription, and AI-powered writing, all requiring users to send what they type to remote servers. Mobile OS vendors set the rules but can't enforce what developers do with that data.