Jon Garside

“AI systems are IT systems—and if we don’t apply the same cybersecurity discipline, we’re asking for trouble.” Martin Stanley, Senior Advisor National Institute of Standards and Technology (NIST) AI starts with applying the cyber fundamentals we already know. That’s the focus of my latest #TechTransforms conversation with Martin Stanley, NIST, someone who’s been shaping the Federal Government’s approach to securing AI from the ground up. From protecting training data to building risk-aware frameworks for generative AI, Martin breaks down the critical steps agencies must take before rushing to deploy. We dig into: -Why AI is still most vulnerable to traditional cyber gaps -How NIST is creating overlays and profiles to secure generative AI -What it takes to prevent model theft and protect training data -Why agencies must prepare for "machine speed" cyber threats -And the power of the simple framework: Govern → Map → Measure → Manage Watch it here:  https://lnkd.in/gmZ8daGu or find it on your favorite podcast platform. What’s the first AI guardrail your organization has put in place? Produced by @Show&Tell #TechTransforms #AI #Cybersecurity #FederalIT #NIST #ShowAndTell #GenAI #AIGovernance Owl Cyber Defense

26

1 Comment

Focusing on the likelihood of success of a threat actor’s TTPs targeting known vulnerabilities in your #OT environment does almost nothing to reduce the severity of potential impacts from a tailored attack. Read more from Danielle J. on Claroty Nexus on what you should be doing instead. https://hubs.li/Q03z-pcq0

1

Tenable announced Tenable Hexa AI, the agentic AI engine of the Tenable One Exposure Management Platform that automates security workflows and transforms exposure intelligence into coordinated action to reduce cyber risk. Read the press release here: http://ow.ly/aAIr106wivH

24

Introducing Vuln0: NetRise's Mission to Triage False Positive CVEs at Scale We took a major step on our Vuln0 journey recently, where our goal is to triage MORE false positive CVEs than anyone else out there in the industry (think Inbox0, but for vulnerabilities). NetRise has been absolutely crushing it with platform releases lately, and I wanted to highlight one of the most impactful features we've shipped: Execution-Aware Reachability.​ As my colleague and CTO Michael Scott pointed out, "the biggest obstacle to operationalizing Software Composition Analysis (SCA) and Binary Composition Analysis (BCA) solutions today is noise." We're talking about inaccurate component detections, vulnerabilities that are technically linked to components but aren't actually exploitable, and findings that should be filtered but aren't due to lack of runtime intelligence.​ When we analyze firmware and software, we typically find hundreds or even thousands of CVEs—an average of 1,120 per networking device. But here's the reality: the vast majority of these are in components that never actually execute. Security teams end up wasting critical time investigating vulnerabilities in dormant libraries while potentially missing the real threats in code that actually runs.​ Our execution-aware reachability capability changes this completely. By mapping the execution chain from autostart entries through scripts to the actual vulnerable components, we're drastically reducing vulnerability noise and helping teams focus on what truly matters: vulnerabilities that can actually be exploited when systems power on or load. This is the difference between theoretical risk and real attack surface.​ What makes NetRise's approach different from others claiming "reachability" is that we're not just doing basic CVE enrichment. Our platform delivers genuine runtime context—including OS and user execution information for components that execute and are reachable (see the image below). We're highlighting the top 1% of findings that remain post-remediation, giving security and development teams actionable intelligence instead of noise.​ This is just Phase I of our reachability capability. Phase II is going to take this even further—stay tuned for tomorrow's post where I'll share how we're tackling a massive percentage of false positive vulnerabilities related to the Linux Kernel. If you're looking for a solution that does more than highlight unfixable problems and actually helps you achieve Vuln0, let's talk. #Vuln0 #SoftwareSupplyChain #Cybersecurity #VulnerabilityManagement #NetRise #SBOM #SCA #BCA

14

1 Comment