Security programs that work. AI governance that's honest. Systems thinking over theater. Disaster Relief Volunteer | A monument to mercy | Views are my own.
Southern U.S.
Joined March 2007
- Tweets14.9K
- Following4.1K
- Followers3.6K
- Likes33.4K
Today I sat in rural Arkansas on the sidelines of a soccer field next to a lovely middle-aged middle-class couple. She had 2 huge stickers on her water bottle.
HATE DOES NOT ABIDE HERE.
MAKE EMPATHY GREAT AGAIN.
——
I’ve been smiling about that all day.
Keith Crawford retweeted
I think the era of rapid detection and response to keep incidents small & contained is going to draw to a close with agentic attacks.
We’re going to have to security engineer our way forward instead. Limit blast radius by design. Brilliance in the basics. It will be more about hardening and configuring what you have (which is hard and slow and boring) vs. reaching for some shiny new product that will solve all your issues
Keith Crawford retweeted
Vulnerability management fell 21 points and privileged access 18, the same year agents got access to source code and production. Securing an agent is mostly access management with a new name. Don't defund the boring stuff your AI plan depends on.
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
Keith Crawford retweeted
There has not been a sweep in the World Series since the Giants swept the Tigers in 2012
the current streak of 14 consecutive World Series with no sweeps extends the longest in history
It’s so good it’s spooky.
Wow. Well done!
We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence.
block.xyz/dessa
Keith Crawford retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
Keith Crawford retweeted
Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.
Keith Crawford retweeted
New PHP2SHell tracker from the @Censysio ARC team :
php2shell.censys.com/
Keith Crawford retweeted
Things keep happening this week, so just so we're all clear on the rules, no one is allowed to disclose vulns or breaches after Friday morning, until Monday. Them's the rules.
Black October vulnerabilities don’t appear to affect core election systems. Timing with the midterms is still awful.
Foreign actors & domestic “skeptics” both have incentives to treat any big cyber event as “evidence” of election interference.
Something to watch.
That guidance about having your cyber insurance and a breach specialist attorney is priceless advice.
I’ll add:
Have a preferred attorney, work to get them pre-approved by your carrier.
(Don’t have one? DM me and I’ll recommend a few.)
Also know when it’s time to tell your team to take their hands off keyboards & get your IR provider engaged.
(Have a preferred vendor, and basic contacts established, even if you don’t have a retainer)
You wouldn’t believe how many startup CEOs I talk to who would be royally screwed if one of their vendors got hacked.
A few months ago, this wouldn’t have mattered for most startups. But we’re entering cyber armageddon.
This is going to happen to you. It’s just a question of when.
The good part is that it’s very manageable. You just need the right mindset and a few processes in place before anything happens. Here’s what I’d be thinking about today.
First (don’t kill me): do you have cyber insurance? And the real question: have you ever actually talked to your broker about using it?
I know this is the last thing you want to deal with, and it’s boring as hell. But please, please call them and make them walk you through it. If your cloud provider gets breached tomorrow, who do you call? What help do they arrange? What needs their approval? What do you pay out of pocket? Get the actual phone number, and save it somewhere you can reach if your work email is down.
Then figure out if your lawyer handles breaches. If they don’t, ask who does and get introduced. Find out how hiring them works with your insurance. You want to know this person exists before you need them.
Next, pull up your customer contracts, especially the big ones. What did you agree to tell them if something happened? You’d think every CEO would know this by heart. Almost none of them do.
What triggers a notification, and who’s supposed to get it? Have someone qualified work through it with you, right now. You might have agreed to something eight months ago and forgotten. Someone at the customer may remember, and if they do and you don’t, you could be very liable. One angry customer with a contract claim can be enough to sink a startup.
Same deal with any security questionnaires you filled out. What did you say you do? Are you doing it? Is it still true?
Then come the business problems. How long could your product be down before you have a real cash problem? What if a big customer pauses payment while you’re also paying outside help? Run the numbers and see where things get uncomfortable. And who can spend money in an emergency? If everything needs your approval and you’re asleep or on a plane, what happens?
Who can take the product offline? This came up in the replies to my last post. Rotating keys can mean an outage, and someone has to decide whether to accept it. Figure out who has that authority before it matters.
Who talks to customers while your engineers are busy? Give that job to one person and make sure they get accurate updates. Otherwise your engineers are investigating while answering the same question from five people. You can draft the bones of those updates now: what we know, what we’re checking, what you need to do, when we’ll update you next. Leave room for uncertainty, and don’t promise things you haven’t confirmed (this happens more often than you think, and can get you in hot water).
Have someone keep a timeline: facts, times, decisions, things you tried that didn’t work. Everyone will be tired and distracted. You will forget.
And where does all of this live? If your plan, contracts, and contacts are all behind the login that’s down, you have a second problem. Try reaching what you’d need without your normal work setup. Make damn sure you can (offline copies are useful here).
Take a look at what you’re exposing, too. Old customer files, exports, recordings, and especially whatever your agents can access. Do you need all of it? Who decided to keep it? Who knows everything you’ve connected, what your agents do during an investigation, and where they’re sending information? Someone needs to own those questions, because every piece of it is future work if something goes wrong.
Then practice. Sit down with whoever would be involved and walk through it. At some point everyone will look at each other and nobody will know the answer. Write that down, and start there.
Bookmark this so you have it when you need it.
