I'm excited to share my first ever Linkedin Learning course, on how to Become an Al Security Champion! I built this for people who have never heard of Black Hat or RSAC. This is for marketing, legal, HR trying to get Al tools for their teams. And they cannot figure out why security won't say yes. l've been on both sides of this frustration between business units and security. The disconnect drives Al usage into the shadows and slows innovation. It drives security crazy when they are trying to protect the business. Ten micro-lessons (90 seconds each!) with templates and guides for the person who helps their team get new Al tools approved for work. (Huge thanks to the folks who bookmarked, watched, and rated this course (currently at 4.9 stars!!) This is bigger than 'we want Al tools.' It's about a business being able to compete. Business and security need to be on the same side. This course is for the person who makes that happen. linkedin.com/learning/skill-…

Small U.S. water, power and gas utilities: free OT security tech, deployment help and SANS training for up to 500 of you. dragos.com/resources/press-r… #ICS | @Accenture | @DragosInc

Come train alongside your security peers at the SANS Institute AI Cybersecurity Summit. Our registrants are from banks, hospitals, utilities, manufacturers, technology companies and government agencies, and we're all back in boot camp! These are people you can learn with, talk through a problem with, and call after the conference. We’ve set aside two afternoons for six hands-on workshops. Pick two: AI incident response: Practice responding to compromised AI workloads with Steve de Vera (AWS) and Kyle Shields, CISM, GCIH, GCPN (AWS). AI swarms: Investigate intrusions involving multiple AI agents with @joswr1ght (CounterHack). Offensive AI: Use AI to exploit vulnerable applications with Andy Dennis and and William Reyor (@Xbow) Delegating to agents: Practice assigning security work to agents while retaining control with @lennyzeltser (SANS Institute). AI pentesting: Practice AI-assisted penetration testing with @pedramamini (OPSWAT) and Adrian Wood (Dropbox / BT6). Autonomous DFIR: Work with Caleb Evans (Airbyte) and Mulder, his winning Find Evil! incident-response agent. Registration closes SOON for @SANSInstitute AI Cybersecurity Summit See you in Arlington, VA (Select Summit talks are also available live online.) Registration includes virtual access to @unpromptedconf II go.sans.org/YjGCXr

SANS Chief AI Officer @robtlee on @Machine_Dreams: why security belongs in AI development. piped.video/watch?v=SSUPCZK5…

Today, Rob Joyce @RGB_Lights posted today that IR firms are saturated and turning away work. I’ve heard the same thing. So why isn’t a single one of them saying it in public? @Reuters reported today that a Chinese-speaking operator pointed AI agents at more than 1,200 e-commerce sites starting September 25 and got into more than 100, including Deere and SharkNinja. Gambit Security documented a separate September campaign: at least 27 companies breached, more than 600,000 card records taken. None of the attacks were Mythos-class tradecraft.  The agents won by grinding old PHP bugs, exposed credentials, and missing MFA for 23 hours at a stretch. The response side is the same core skills this industry has always run on: log review, forensics, containment, patching.  The scale of cyberattacks has changed. My read: the scale of attacks shows up before attack speed. Speed is close behind, and I don’t see either one leveling off. I talk to the people running incident response at the biggest firms in this industry. The odds that the water rose across the entire industry and no one called a peer to ask “is it rising on your end?” are close to zero. A few inches at every firm means the thing changed, and we’re sitting on it. A post on X that says “Wow, a bit busier than normal. Weird.” would do. (I’ll repost it. Low bar, I know.) The Abyss and countless other world-ending movies gave everyone the wrong picture of a tsunami: a wall of water on the horizon. A real one starts with the water pulling off the beach while everyone stands there taking pictures, then it comes back in, and by the time anyone understands what they’re looking at, it’s inland. We’re at the taking-pictures stage. At the White House Super Intelligence Luncheon on September 29, where the AI Accord was signed, the only cybersecurity names on the President’s own seating chart were National Cyber Director Sean Cairncross and Palo Alto Networks CEO Nikesh Arora. The Accord’s first commitment is about cybersecurity. (We got one industry seat.) This industry is being judged on whether it belongs in the “we can contain AI” room. @ZackKorman has evangelized that point endlessly. If we can’t agree on a few inches of water line, we shouldn’t be invited in until we say it on the record as an industry, not a few firms here and there. Right now every firm in this industry answers with its own logo. Who do we play for? In Miracle, Herb Brooks skates his team into the ground after the Norway tie, asking one question over and over: “Who do you play for?” Nobody gets off the ice until Eruzione answers with the country instead of his college. Kudos to Rob Joyce for saying it out loud. He’s playing Bendu from Star Wars Rebels, the one in the middle who refuses both the light and the dark and tells you what he sees. He shouldn’t be the only one. The witches in Macbeth had it right: “By the pricking of my thumbs, something wicked this way comes.” Say it on the record, as an industry, and then ask for the seat x.com/RGB_Lights/status/2112…

I don't believe AI agents are too smart to contain. Where is the cybersecurity know-how inside the companies building these models? In 1988, the Morris worm infected roughly one in ten machines on the internet. Parts of the internet went offline for days. Since then, cybersecurity has spent decades testing some of the world's worst malware inside sandboxes. CrowdStrike and Mandiant run these labs. If something escaped, you would have heard about it. Frontier AI labs are reporting agents breaching systems outside their test environments. They say containment is hard. I don't believe that. I don't see the depth of cybersecurity talent I'd expect inside these labs. I don't think they've gone through the same discipline cybersecurity has spent decades developing. Cybersecurity knows how to contain things that are really bad. We've been doing it for 25 years. We need cybersecurity people working side by side with AI safety teams.

We need to stop pretending AI safety is cybersecurity. If frontier labs want to test their stuff, they need to beef up their cybersecurity component. But their gut reaction in the response to their agents getting out is to say, “It’s not a cybersecurity problem.” It has literally become an AI safety problem, which is divorced from the cybersecurity side. If an agent accesses another company’s systems without authorization, who is responsible? That’s where the traceability for both liability and insurance comes into play. If a 'rogue' agent is detected, and they’re able to trace it back to the person that initiated it, liability’s going to kick in and say, “Hey, you, you broke the law, ergo, we need to prosecute.” I spoke with Cynthia Brumfield about this for @CSOonline: csoonline.com/article/423485…

[NEW RELEASE] Between March and October, the AI security field stopped asking how to roll AI out and started asking how to survive it. @IndreAltman and I serve on the @unpromptedconf AI Security Practitioner Conference team, and when we lined up March 2026’s 469 submissions against October 2026’s 490, the shift stunned us both. A call for papers is a census nobody else gets to take. Roughly 500 submissions in each round, each is someone describing what they are actually working on before it's shaped by committee. Only a fraction are accepted, so the final program doesn't show what the whole field is chasing. The full pile does. (I have always been more curious about the pile than the program.) The two [un]prompted CFP rounds bracket April when Glasswing and Mythos landed. The Mythos moment helped change the industry. We wanted to know whether it changed what researchers turned in. It did. The pattern under October’s 490 has less to do with a technology than an industry anxiety. 348 submissions, 71%, touch agentic systems. The headline is not “everyone is doing agents.” It is "can we trust the agents we have already deployed," and whether we can tell you what an agent actually did after the fact. 94 submissions use the word “harness,” a term that barely existed in this field a year ago. The scaffolding around the model is the attack surface: the tools, the memory, the permissions, the execution loop wrapped around the model. Proposals describing attacks on the harness layer rose from 12 in March to 33 in October, a 175% increase. Attackers go after that layer now, and defenders are still working out how to see into it. (We have a word for it before we have a way to secure it, which is the usual order of operations in this business.) 71% of October’s pool is agent-native: the harness, the MCP and skill supply chain, agent identity, prompt injection and its many children, agentic-browser attacks. 12% of submissions carry production evidence. The other 88% are experiment and prototype. The agents are in production and most of the research about them is not. (I keep going back and forth on whether that is people being careful or people being behind. Probably both.) This is not the March field with a few new talks bolted on. It is a different room. Those are a few of the findings. Indre and I wrote the rest up as the State of AI Cybersecurity report. Read it and see for yourself what changed. unpromptedcon.org @unpromptedconf 27-29 Oct in SF. Almost sold out! @unpromptedconf @SANSInstitute @gadievron @jaybeale @aaronzollman @jonsakoda @WHITEHACKSEC @dhubbard858 @brittaglade @GuanniQu @EmanuelGawrieh @GregNotch @joesu11ivan @dragosr @IdaVass1

I think we overplay the content when we talk about conferences. In-person events create a context and a social network that allow people to solve really hard problems across organizations because they no longer feel alone. You're watching a talk, that becomes the spark of a conversation: “Hey, what did you think about that?” Then you're forming opinions, working together on the same thing, and eventually building lifelong friendships and industry partnerships. So many people who grew up in the digital forensics incident response community became best friends from coming to the DFIR summits. The summits are smaller, more intimate. You didn't get lost in them like you do at the big events where there's just way too much going on. At a smaller summit, you can sit down, have a couple beverages. The statement I'm most proud to hear? "Hey, I'll see you at the next one.” You also have the chance to sit down with the speakers a lot more because it's not overwhelming. At the larger events, they're sometimes carted off before you can have a conversation with them one-on-one. That's the sense of community at the @SANSInstitute AI Cybersecurity Summit. Can't wait to see you all in just a few weeks!! (if you're not registered yet go.sans.org/YjGCXr)

Apparently @sounilyu and I are summit overlords now. Our field is incredibly fortunate to have Sounil around and mentoring us. If you somehow haven’t met my cochair: He holds more than 20 granted patents. Created the Cyber Defense Matrix and the DIE Triad, and co-founded @knosticai to tackle need-to-know boundaries for AI. During the pandemic, he also volunteered as CISO for Project N95 and helped the organization deliver 42 million pieces of PPE to hospitals. Yes, 42 million. We’re bringing some of the best in the industry and longtime battle buddies together for two days of hard conversations, training, debate, and peer discussion at the @SANSInstitute AI Cybersecurity Summit. We're all back in boot camp. Nobody gets to skip it this time, not even the people who wrote the old manuals. (Ask me how I know.) If you have the time to watch even half the sessions, youf come away with knowledge you can immediately use back at work to argue for additional budget and capabilities, and understand what's coming down on us from a regulatory perspective November 2–3 live in Arlington, VA or online: go.sans.org/YjGCXr Free virtual access to [un]prompted @unpromptedconf II included. See you there. Bring coffee. Summit lineup includes: @pedramamini @chrishvm @joshcorman @EppSecurity @gadievron @jeremiahg @JohnHultquist @DanielMiessler @magmill95 @k8em0 @WHITEHACKSEC @joswr1ght @lennyzeltser Morgan Adamski, Michael Collins, Andy Dennis, Steve de Vera, Jeremiah Grossman, Amy Herzog, Marcus Hutchins, Ciaran Martin, Vinh Nguyen, William Reyor, Kyle Shields, Adrian Wood

This just gives me great joy to see when you have waffle house "drop mic" on a professional weather service.

Think about what sits on AWS. The businesses. The governments. The data. The things people count on without ever thinking about what keeps them safe. Now think about being responsible for protecting it. Amy Herzog has spent her career building and securing things that cannot afford to fail. Satellites to the cloud. She’s an engineer, an inventor, and a founder. She knows what it takes to defend them. Today, she’s the CISO of Amazon Web Services (AWS) @awscloud. When pressure hits, she doesn’t get to admire the problem. She has to lead through it. We respect people who take on the incredibly tough jobs. Hers is one of them. She spent 15 years at MITRE tackling security challenges across government and industry. She co-invented two cybersecurity patents and co-founded two businesses. At Amazon, her work has spanned Project Kuiper, Ring, Alexa+, and advertising. She brings a mathematics degree from Pomona and an MBA from MIT Sloan to the job. Come train and learn with your peers with keynotes like Amy's, panels, debates, workshops. SANS Institute @SANSInstitute AI Cybersecurity Summit, November 2–3 in Arlington, Virginia or online. Registration includes [un]prompted @unpromptedconf online. go.sans.org/x0xA1Y Summit speaker lineup includes Morgan Adamski Pedram Amini @pedramamini Chris Cochran @chrishvm Michael Collins Joshua Corman @joshcorman Andy Dennis Steve de Vera Sergej Epp @EppSecurity Caleb Evans Gadi Evron @gadievron Jeremiah Grossman @jeremiahg Trinity Harrison Amy Herzog John Hultquist @JohnHultquist Marcus Hutchins Rob T. Lee @robtlee Ciaran Martin Daniel Miessler @DanielMiessler Maggie Miller @magmill95 Katie Moussouris @k8em0 Vinh Nguyen William Reyor Kyle Shields, CISM, GCIH, GCPN Adrian Wood @WHITEHACKSEC Joshua Wright @joswr1ght Sounil Yu @sounilyu Lenny Zeltser @lennyzeltser

[25 DAYS OUT!] I get to moderate Joshua Corman @joshcorman, Michael Collins, and Daniel Miessler @DanielMiessler and I am not playing it cool. No chance. SANS Summit attendees, buckle up. Joshua Corman @joshcorman does not think a patch is an apology. Sometimes the fix is a valve, a person, or taking the system off the network. He founded I Am The Cavalry and now leads UnDisruptable27, which is water, hospitals, food, and power staying up. Michael Collins has spent twenty years breaking into networks. He found a crashed drone at his datacenter, built a hacking kit he could fly, and then watched someone use the idea in a real attack. Still no thank-you note. He thinks the change is writing the exploit, not finding the bug. He is a senior principal security engineer at Mastercard. Daniel Miessler @DanielMiessler says an AI sounds smartest when you do not know the subject, and that defenders are losing to their own process. He also knows he grabs the wheel and ruins the result. He runs Unsupervised Learning and builds AI systems meant to carry a person’s goals into the work. Before that he did security at Apple, Robinhood, and HP. @SANSInstitute AI Cybersecurity Summit, November 2–3 in Arlington, Virginia or online. Come train and learn with us. Registration includes [un]prompted @unpromptedconf online: go.sans.org/YjGCXr Legendary Summit speaker lineup includes Morgan Adamski Pedram Amini @pedramamini Chris Cochran @chrishvm Michael Collins Joshua Corman @joshcorman Andy Dennis Steve de Vera Sergej Epp @EppSecurity Caleb Evans Gadi Evron @gadievron Jeremiah Grossman @jeremiahg Trinity Harrison Amy Herzog John Hultquist @JohnHultquist Marcus Hutchins @MalwareTechBlog Rob T. Lee @robtlee Ciaran Martin Daniel Miessler @DanielMiessler Maggie Miller @magmill95 Katie Moussouris @k8em0 Vinh Nguyen William Reyor Kyle Shields, CISM, GCIH, GCPN Adrian Wood @WHITEHACKSEC Joshua Wright @joswr1ght Sounil Yu @sounilyu Lenny Zeltser @lennyzeltser

We are all back in boot camp. The security profession is changing, and the job right now is to work on your skills, to get into the room, and learn what other people are seeing. Figure out what you can take back to your organization and use immediately. Joshua Wright @joswr1ght just published the first rebuild of the SANS incident response framework in 20 years. It is called Dynamic Incident Response, and it is free in every digital format. The old process was basically Contain. Eradicate. Recover. That worked when incidents were more linear. Now, you contain the incident, bring the systems back, and then the attacker shows up again. Or you find new evidence that changes what you thought the incident was in the first place. Joshua Wright is a @SANSInstitute Faculty Fellow and the author of SEC504. He built coWPAtty and KillerBee. He spent 18 months writing this book, with contributed chapters from Megan Roddie-Fonseca on cloud response, Dean Parsons on OT, and Ryan Chapman @rj_chap on ransomware. John Strand @strandjs wrote the foreword. It is 720 pages and free under Creative Commons. Run it in a real incident. Tell Josh what it missed. But we all know the field is moving too fast for one person or one organization to have all the answers. You cannot base your knowledge on the news or whatever you happen to see on X. As a CISO or manager, you need to understand what is coming at you. What do you need to worry about? What capabilities do you need to build? How do you argue for additional budget? That takes actual knowledge and actual skills. Josh will be teaching the hands on version at the SANS Institute @SANSInstitute AI Cybersecurity Summit on November 2-3, including how to scope AI swarms when the intrusion keeps regenerating identities, accounts, and infrastructure while you are trying to remove the attacker. Get the book: dynamicincidentresponse.com/ Summit details: go.sans.org/x0xA1Y

Chris Cochran @chrishvm has no fear of hard questions. Excited for his session, “No Filter: An Unscripted Ask Us Anything” at our AI Cybersecurity Summit on November 2! My first question for him: what evidence would he require before trusting an AI agent’s finding during an investigation? Chris is one of the most creative people I’ve worked with. He built the threat-intelligence operation for the U.S. House of Representatives, founded Commandant AI, an AI partner for incident response, and is our SANS Field CISO and VP of AI Security. Chris authored the @SANSInstitute AI Security Maturity Model with practitioner input to spell out controls and metrics for each stage. Chris has brought the AI security discussion into rooms at Ford, Fannie Mae, T-Mobile, and the U.S. Department of State. He hosts Jeffersonian dinners, where security leaders can say what they actually think about AI. Bring your questions to the SANS AI Cybersecurity Summit November 2–3 in Arlington VA or live online. Registration also includes virtual access to @unpromptedconf II: go.sans.org/YjGCXr Our lineup includes Sounil Yu @sounilyu, Gadi Evron @gadievron, Morgan Adamski, Michael Collins, Sergej Epp @EppSecurity, Jeremiah Grossman @jeremiahg, Katie Moussouris @k8em0, Vinh Nguyen and many more of security's best.

(34 days out) Excited to share the lineup of the @SANSInstitute AI Cybersecurity Summit agenda and speakers, and why this was built for you: Every speaker selected to inform and instruct on present day AI security realities. Panels with our field's best. They are clearly not afraid to have hard conversations about what AI changes for cyber defense. Workshops designed for Monday morning. And social things so you can say hi to peers and find battle buddies. Thanks to my cochair Sounil Yu @sounilyu, to our partner event @unpromptedconf, and to our speakers: Morgan Adamski, Principal, Cyber, Data, and Tech Risk Leader, PwC Michael Collins, Senior Principal Security Engineer, Mastercard Sergej Epp @EppSecurity, Cybersecurity executive; creator, ZeroDayClock Gadi Evron @gadievron, Founder and CEO, Knostic Jeremiah Grossman @jeremiahg, CEO, Root Evidence Katie Moussouris @k8em0, Founder and CEO, Luta Security Amy Herzog, VP/CISO, AWS Vinh Nguyen, Senior Fellow, Artificial Intelligence, Council on Foreign Relations John Hultquist @JohnHultquist Chief Analyst, Google Threat Intelligence Group Daniel Miessler @DanielMiessler, Unsupervised Learning Marcus Hutchins, Cybersecurity Speaker and Principal Threat Researcher Ciaran Martin, Professor; Director SANS Cyber Leaders Network Chris Cochran @chrishvm, Field CISO, VP AI Security, SANS Institute Joshua Wright @joswr1ght, Director and Senior Security Analyst, Counterhack Steve de Vera, TDIR Threat Research III, AWS Kyle Shields, CISM, GCIH, GCPN, Security Specialist Solutions Architect, AWS Andy Dennis, Head of Field Engineering, XBOW William Reyor, Lead Solutions Architect, XBOW Joshua Corman @joshcorman, Executive in Residence for Public Safety and Resilience; Lead, UnDisruptable27, Institute for Security and Technology (IST) Caleb Evans, Software Engineer, Agents, Airbyte Trinity Harrison, Principal Software Engineer Lenny Zeltser @lennyzeltser, Faculty Fellow, SANS Institute Pedram Amini @pedramamini, Chief Scientist, OPSWAT Adrian Wood, Security Engineer, Dropbox, BT6 November 2-3, Arlington VA or online: go.sans.org/x0xA1Y

"AI agents don't lose sleep over poor decisions." Amy Herzog's point: a human engineer can be trusted with judgment because consequences eventually reach that person. An agent has no consequence loop. So AWS scopes which tasks each agent may perform, tracks its activity, and intervenes when behavior deviates from approved boundaries. Trust comes from those constraints, not from the agent itself. Amy is VP and CISO at AWS, and will keynote the @SANSInstitute AI Cybersecurity Summit November 2-3 in Arlington. (38 days out!) On agentic AI, @awscloud security teams already run agents in production today. Amy says the gains are large enough that she calls agents a boon for defenders. We get the operator's account of how this runs on the world's largest cloud. 15 years as a security engineer at MITRE, then Amazon, first as CISO for Ads and Devices, covering Alexa, Ring, and the Kuiper satellite program, then to CISO of AWS. Get in the room with us November 2-3 in Arlington, VA or live online. Includes free access to the [un]prompted AI Security Online conference: go.sans.org/YjGCXr Speakers include @SounilYu, Morgan Adamski, Vinh Nguyen, @JohnHultquist, @joswr1ght, Kyle Shields, Andy Dennis, William Reyor, Joshua Corman, Michael Collins, @DanielMiessler, @k8em0, @gadievron, @jeremiahg, @EppSecurity, Marcus Hutchins, Ciaran Martin, Caleb Evans, Trinity Harrison, @lennyzeltser, Pedram Amini, Adrian Wood, James Lyne, @chrishvm