🚀 Excited to share my latest Governance, Risk, and Compliance (GRC) project completed on Cyberr, where I engineered an audit-ready, mini-Information Security Management System (ISMS) from the ground up. Simulating the role of a Cybersecurity Governance, Risk and Compliance Cons…
Schomer — Principal Security Solutions Architect & Founder
🚀 [PROJECT MILESTONE] Secure Agentic Commerce is Here: Introducing ETB PayShield for the PayPal AI Hackathon High-volume digital checkouts and autonomous AI commerce flows face an overlooked vulnerability vector: traditional application security configurations run too high up t…
Jason Murray — Strategic Information Security Leader Championing Quantified Risk Analysis and Security Process Improvement.
Joshua Saxe argues that waiting for interpretability to prove models safe is the wrong frame for AI safety and security. I'd go further: in general it can't be done, not just not yet. "Will this agent ever take a harmful action?" is a question about what a program does, and sinc…
One stolen password can become an entire security incident. The problem isn't always the password itself. It's what that identity can reach. A compromised account may provide access to: → Email and collaboration tools → Cloud consoles → Internal applications → Customer informati…
Schomer — Principal Security Solutions Architect & Founder
The system isn't just breaking—it’s completely blind. Look at the Cyberr threat feed over the last hour. Three massive stories just dropped that prove application-layer, identity-based security is entirely obsolete: 1️⃣ BAE Systems Hacked: A cyberattack on a defense giant has kn…
When Machines Act for Us, Integrity Becomes the Security Question Picture a procurement agent asked to cut supplier costs by ten percent. It reads the contracts, finds a cheaper vendor, cancels three standing orders and signs a new agreement before lunch. No attacker was involve…
Schomer — Principal Security Solutions Architect & Founder
Machine-Speed Exploits Require Pre-Execution Layer Zero Trust We are watching the cyber-attack lifecycle shrink from days to minutes. Threat actors are no longer just writing malware; they are deploying agentic frameworks to automate the discovery of existing software flaws and…
Schomer — Principal Security Solutions Architect & Founder
📦 The software supply chain surface just expanded again. For the first time, threat actors are actively using the centralized HashiCorp Registry to distribute malicious Go-based payloads disguised as legitimate Terraform providers. This highlights a massive systemic risk: engin…
In OSINT and security operations, note-taking is not a habit. It is a foundational discipline. But discipline without security is just evidence collection for the other side. Your notes tie intelligence to action; and they are a single point of catastrophic failure if handled in…
To every engineer over 45 who can't get a callback: Stop applying. Start shipping. Every closed product you're locked out of working on is a feature list, and agents have collapsed the cost of building one to nearly nothing. What agents can't supply is thirty years of knowing wh…
The security baseline for digital assets and stablecoins is rising fast — and the real challenge today is aligning 𝐭𝐡𝐫𝐞𝐚𝐭 𝐯𝐞𝐜𝐭𝐨𝐫𝐬 with 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤𝐬 that regulators actually expect. I’ve published an enhanced CISO briefing that maps every major…
Winter Stores Day 6: Store. Resilience is food stored before winter. DORA Art 11: backups that work when primary dies. My winter store: break-glass tested monthly, IAM config backed up daily, runbook printed. Ants survive winter. So will your fintech. #Resilience #DORA
Imrane T. — Offensive Security | Attack Chains & Business Logic
13 high-impact security issues in 11 days of exploration No bounty programs. No responses. Over the past days, I analyzed multiple SaaS / Web3 / API-driven platforms from an external perspective only ,no insider access, no credentials beyond what’s publicly exposed. What came ou…
The Builders Compliance isn’t one big rock. It’s puzzle pieces. My ants don’t carry crumbs. They carry DORA, NIS2, MFA, Zero Trust. One piece at a time = an audit trail you can show. I map each piece to a Jira ticket. No ticket, no proof. Want the template? DM “ANT” #IAM #DORA #…
Mover Monday Movers are where companies die 🐜📦 Role changed last week? Old access removed? Most breaches aren’t joiners or leavers. They’re movers with lingering admin rights. My 48h mover audit: HR feed → IAM → AD groups → ticket proof No lingering rights. No “they still have…
Scout Saturday Scout checks break-glass accounts 🐜🔭 Last test? If >90 days, you’re not resilient, you’re lucky. DORA hates luck. My scout routine: locate break-glass in vault test login (no MFA bypass) log evidence with timestamp rotate secret No test = audit finding. I docume…
André Ataíde — Systems Analyst – Supply Chain & ML Security
Software release decisions tend to leave no trail. The scanner ran, flagged something, someone decided to act (or not), but that decision got lost in a Slack thread, in a call, or ended up somewhere that doesn't survive an audit. It's a pattern that repeats everywhere, for the m…
TUESDAY — Worker Carries the Ticket Hook: "Worker won't move without a ticket." Post: ant carrying a leaf labeled "change #1234". "No ticket, no tunnel. That's NIS2 Art 21. My worker script checks for ticket_id before elevation." CTA: DM "WORKER" for the script