The Dangerous Moment Is the State Change: Security Testing for Connected Devices

Posted on October 27, 2026 by Brent Huston

The firmware image passes static analysis.

The administrative interface survives a penetration test. The network scan shows only approved services. The mobile application and cloud API have been reviewed. The device enters production with a clean report.

Then the device changes state.

A technician enters maintenance mode. An update loses power halfway through installation. A factory reset prepares the device for a new owner. A recovery process restores an older image. A field engineer connects to a local service interface. A retired device remains registered to a cloud account.

The controls that worked during normal operation may not work the same way during any of those transitions.

That is the testing gap.

Connected-device security is usually evaluated as a collection of components and attack surfaces: firmware, hardware, network services, wireless interfaces, applications, APIs, and cloud infrastructure. Each view matters. None of them, by itself, proves that the product preserves its intended trust state when it is provisioned, updated, interrupted, repaired, reset, transferred, recovered, or retired.

The practical lesson is straightforward:

Device security assurance should test the transitions that change authority, software, data, and operating mode—not only the device’s steady state.

A Connected Product Has More Than One Security State

A connected device is not simply secure or insecure.

It moves through states.

The lifecycle may include manufacturing, initial provisioning, normal operation, degraded operation, maintenance, software update, rollback, recovery, factory reset, ownership transfer, and retirement. Some products add calibration, emergency operation, offline modes, safety overrides, diagnostic modes, or vendor-support access.

Each state can change:

Which identities are trusted.
Which interfaces are reachable.
Which code is allowed to run.
Which secrets are present.
Which data is retained.
Which actions are permitted.
Which events are logged.
Which recovery paths are available.

The current NIST IR 8259 Revision 1, finalized in April 2026, tells IoT product manufacturers to define expected customers and use cases, identify cybersecurity requirements, and plan how the product will support customer risk management. The companion NIST IR 8259A baseline includes device identification, configuration, data protection, logical access to interfaces, secure software update, and cybersecurity-state awareness.

Those capabilities do not exist only during normal operation.

They must remain meaningful while the product changes state.

Steady-State Testing Can Miss Transition Risk

Static firmware analysis can identify exposed secrets, unsafe configurations, vulnerable components, dangerous functions, and other defects inside an image.

Dynamic testing can examine running services, authentication, authorization, input handling, communications, and runtime behavior.

Hardware and interface testing can examine local access paths that a remote network assessment will never see.

Application and API testing can evaluate the services that control the device, store its data, and connect it to other systems.

The OWASP IoT Security Testing Guide reflects this broader reality by organizing testing around the device model, firmware, interfaces, communications, and runtime behavior rather than treating an IoT product as a single web endpoint.

The transition problem appears between those views.

Consider the questions created by an update:

Who is allowed to initiate it?
How does the device authenticate the update source and verify the image?
Can an authorized image be replayed after it should have expired?
What happens if power, storage, or connectivity fails halfway through installation?
Does rollback return the device to an older but vulnerable state?
Are security settings, keys, and logs preserved correctly?
Does the device report that it is running a degraded or unexpected version?

Now consider a factory reset:

Which user data is removed?
Which device identity and cryptographic material remain?
Are cloud registrations, mobile-app bindings, or vendor accounts disconnected?
Does the reset restore an unsafe default configuration?
Can a previous owner or administrator still reach the product?
Is the reset event visible to the next operator?

A review that tests only the stable image before and after the transition may miss the condition created during the transition itself.

Build a State-Transition Test Model

Start with a state diagram, not a tool list.

For each important transition, create a compact test record with six fields.

1. Entry condition: What starts the transition?

Identify the command, signal, physical action, scheduled event, fault, account action, or environmental condition that moves the device out of its current state.

Examples include an update request, boot failure, service-button sequence, cloud command, expired certificate, loss of connectivity, storage exhaustion, ownership transfer, or operator decision.

The entry condition should be testable. If the team cannot reproduce the condition safely, it cannot demonstrate how the product behaves when the condition occurs.

2. Authority: Who or what may cause it?

Name every actor that can initiate, approve, block, or complete the transition.

That may include the device owner, local administrator, vendor support team, cloud service, companion application, update-signing system, physical technician, automation service, or another device.

Then test the boundary between those roles.

An identity authorized to read device status should not automatically gain authority to install firmware. A field technician permitted to run diagnostics should not silently become a permanent administrator. A cloud service that can request an update should not be able to bypass the device’s independent verification of the image.

3. Protected state: What changes or persists?

List the assets and security properties that the transition can modify:

Firmware and boot components.
Configuration and policy.
Credentials, keys, certificates, and trust anchors.
User, customer, operational, or diagnostic data.
Device identity and ownership records.
Local and network interfaces.
Logging and monitoring state.
Safety limits and operating parameters.

Testing should confirm both what changes and what must not change.

4. Failure path: What happens when the transition does not finish normally?

Interrupt the process in a controlled environment.

Remove a dependency. Deny a required authorization. Present an invalid or older image. Exhaust an expected resource. Break connectivity at a defined step. Restart the device while state is being written.

The purpose is not to create theatrical destruction.

It is to learn whether failure moves the product into a secure, observable, and recoverable condition.

5. Evidence: What proves the resulting state?

Define the evidence an operator, customer, assessor, or incident responder can use to determine what happened.

That may include version and integrity measurements, event logs, update records, administrative actions, device-state reports, cloud audit records, tamper indicators, recovery results, or retained forensic artifacts.

If the device cannot explain its own security state, the organization may have to guess whether the transition succeeded.

6. Consequence: What can the new state affect?

Connect the technical result to the product’s real use.

Could the device disclose data, stop a business process, permit unauthorized control, produce incorrect measurements, lose availability, weaken a safety function, or become impossible to recover remotely?

The same technical defect can have very different significance in a consumer accessory, payment device, building controller, medical product, industrial sensor, or safety-related system.

Protect, Detect, and Recover

Device assurance is incomplete if it tests only whether unauthorized change can be prevented.

NIST SP 800-193 organizes platform-firmware resilience around three goals: protect the platform from unauthorized change, detect unauthorized change when it occurs, and recover rapidly and securely.

That sequence is a useful testing standard.

Protect

Verify that only authorized entities can initiate the transition and that the device independently validates the software, configuration, or command it is about to trust.

Test version policy, signing, authorization separation, local access controls, service interfaces, and the protection of keys and trust anchors.

Detect

Verify that the product can recognize and report an incomplete, unauthorized, degraded, or unexpected state.

An update mechanism that rejects a bad image but leaves no useful record may protect the device while weakening incident response. A device that boots a fallback image without reporting the version change may remain operational while concealing a material security event.

Recover

Verify that recovery returns the product to an intended trust state, not merely to an operable state.

The device may power on and still be running an obsolete image, unsafe configuration, untrusted key set, or diagnostic mode. Recovery evidence should show what was restored, which trust decision authorized it, and what follow-up action remains.

Physical Consequence Changes the Test Plan

Connected products can affect more than data.

The final NIST SP 800-82 Revision 3 defines operational technology broadly as programmable systems and devices that interact with the physical environment and emphasizes that security measures must account for performance, reliability, and safety requirements.

That changes how testing should be performed.

An aggressive production scan, unplanned reboot, malformed command, or interrupted update may be acceptable in a disposable lab unit and unacceptable in a live operational process. Some questions should be answered through offline firmware analysis, emulation, configuration review, representative hardware, isolated test networks, or a controlled lab before anyone considers validation in the field.

The test plan should distinguish:

What can be examined without operating the device.
What can be exercised safely on representative hardware.
What requires an isolated system or simulated environment.
What must be validated in the deployed environment under a carefully approved procedure.
What should not be tested actively because the safety or availability consequence is unacceptable.

Restraint is part of good testing.

The objective is not to prove that the assessor can break the device.

It is to produce useful evidence without creating the harm the assessment is supposed to prevent.

Scale Assurance by Consequence and Change

Not every connected product needs the same depth of testing.

A low-consequence, easily replaced device with no sensitive data and minimal authority does not need the same assurance program as a long-lived controller that can alter a physical process.

Set the testing tier using factors such as:

Safety and operational consequence.
Access to sensitive data or privileged actions.
Exposure to untrusted networks, users, or physical access.
Authority of local, wireless, cloud, and service interfaces.
Complexity of update, rollback, and recovery mechanisms.
Dependence on companion applications, APIs, and vendor cloud services.
Expected service life and ability to replace the product.
Availability of logs, integrity evidence, and emergency recovery.

Then define retest triggers.

A new firmware branch, bootloader, hardware revision, wireless stack, update service, cloud backend, cryptographic design, manufacturing process, or field-service workflow can change the transition model even when the product name remains the same.

The current NIST IR 8259 Revision 1 reinforces this lifecycle view by asking manufacturers to consider customer needs, product requirements, risk mitigations, and the support customers require to use the product securely.

Security testing should follow the product as those conditions change.

Measure Transition Assurance, Not Just Defect Counts

A vulnerability count is useful for remediation tracking.

It does not show whether the product preserves trust across its lifecycle.

More useful measures include:

Percentage of high-consequence state transitions represented in the test model.
Percentage of update and recovery paths that independently authenticate software and enforce version policy.
Percentage of reset, transfer, and retirement paths that remove customer data and obsolete account bindings as designed.
Percentage of maintenance and diagnostic actions attributable to a named identity.
Percentage of interrupted transitions that produce an observable security-state record.
Time required to recover a representative device to a known, supported, and verified state.
Number of product changes that altered the threat model but did not trigger security retesting.
Percentage of critical transition tests that include the companion application, API, cloud service, and deployed operating assumptions.

One question is especially revealing:

After an update, reset, or recovery fails, can you prove which trust state the device is in?

If the answer depends on a visual guess, undocumented service sequence, or the memory of one engineer, the product may be recoverable without being governable.

What Security Leaders Should Do This Week

Choose one connected product with meaningful business, safety, privacy, or operational consequence.

Draw its states. Include provisioning, normal operation, update, degraded operation, maintenance, recovery, reset, transfer, and retirement where applicable.
Name every transition authority. Identify who or what can initiate, approve, complete, or block each state change.
Map what changes and persists. Include software, configuration, identities, keys, data, interfaces, logging, and cloud bindings.
Choose one failure path. Safely interrupt an update, recovery, reset, or maintenance workflow on representative equipment.
Verify protect, detect, and recover. Confirm that unauthorized change is prevented, abnormal state is visible, and recovery restores a supported trust state.
Connect the result to consequence. Decide what the observed behavior could mean for safety, operations, customers, data, and incident response.
Set the retest triggers. Require reassessment when a material component, interface, update path, backend dependency, or field workflow changes.

A secure firmware image matters.

A hardened interface matters.

A tested API matters.

The product still has to move safely between the states that join those components together.

Test the transition.

That is where the device changes what it trusts.

Put MicroSolved’s Device and Lab Testing Experience to Work

MicroSolved, Inc. can help organizations evaluate industrial, IoT, embedded, and connected products through controlled, evidence-driven security testing.

MSI can assist with:

Product threat modeling and state-transition test design.
Firmware extraction, static analysis, emulation, and controlled runtime testing.
Review of local, network, wireless, service, application, API, and cloud interfaces.
Update, rollback, reset, maintenance, recovery, and retirement-path validation.
Embedded-device, firmware, AMI, SCADA, segmentation, and tamper-resistance assessment.
Test planning for high-availability, safety-sensitive, and critical-infrastructure environments.
Prioritized mitigation guidance that connects technical findings to business and operational consequence.

To discuss connected-device, firmware, industrial, or lab testing, contact MicroSolved at info@microsolved.com or +1.614.351.1237.

Relax. We’re on watch.

AI tools were used as a research assistant for this content, but human moderation and writing are also included.

The Network Is the Configuration: Why Device-by-Device Reviews Miss Systemic Risk

Posted on October 14, 2026 by Brent Huston

The firewall passes its review.

The router matches its hardening guide. The core switches have approved templates. The VPN concentrator is supported. The wireless controllers have current settings. Each team can point to a device, a checklist, and a green result.

The environment can still be unsafe.

A route may bypass the intended boundary. An emergency access rule may have become permanent. Two business units may use different authentication sources for the same administrative function. A management interface may be reachable from the wrong zone. Logging may be enabled on the newest devices and absent from the oldest ones. A segmentation design may exist in a diagram without being enforced consistently across the equipment that implements it.

The failure is not necessarily inside one device.

It lives in the relationships among them.

That is the limitation of device-by-device configuration review. It can tell an organization whether individual components satisfy selected requirements. It may not show whether the combined environment still implements the security architecture the organization believes it has.

The practical lesson is straightforward:

Configuration assurance should prove the effective state of the environment, not merely the acceptability of isolated devices.

The Network Does Not Experience Controls One Device at a Time

Standards correctly require secure configuration practices.

NIST Special Publication 800-128 describes security-focused configuration management as the work of managing and monitoring system configurations to support business functionality while reducing organizational risk. The CIS Controls call for maintained secure configurations across enterprise assets and software, while CIS Control 12 focuses on actively managing network devices so vulnerable services and access points do not become attacker paths.

Those practices create necessary baselines. The harder question is whether the baselines compose into the intended result.

Consider segmentation.

One firewall may correctly restrict traffic between two zones. That does not prove there is no alternate route through another firewall, a cloud connection, a VPN profile, a shared management network, a wireless bridge, or a vendor access path. Each component can look reasonable in isolation while the system still permits a path the architecture was intended to prevent.

The same problem appears with authentication, logging, encryption, administrative access, name resolution, and trusted-host definitions. The control is often distributed across products, vendors, versions, teams, and locations. Its effectiveness depends on consistency and relationships.

A useful review must therefore ask two different questions:

Is this configuration acceptable for this component?
Does this collection of configurations enforce the intended control across the environment?

The first question finds local defects.

The second finds systemic risk.

Separate Intent, Implementation, and Effective State

Most organizations have at least three versions of their network.

The intended network

This is the architecture described in diagrams, standards, policies, design documents, approved data flows, and segmentation plans. It explains what the organization expects the environment to do.

The implemented network

This is the collection of current device and application configurations: routes, access-control lists, VLANs, authentication servers, management interfaces, DNS settings, logging destinations, encryption choices, firmware versions, and exceptions.

The effective network

This is what those configurations permit, deny, trust, expose, record, and connect when they operate together.

The three should agree. They often diverge because organizations change continuously. Acquisitions introduce new standards. Cloud services create new paths. Vendors receive temporary access. Emergency rules survive the event that created them. Hardware generations overlap. Different teams interpret the same policy differently. A compensating control exists in one region and is assumed to exist everywhere.

The September 2026 edition of the Australian Signals Directorate’s Information Security Manual guidance for networking illustrates the breadth of evidence involved. It calls for maintained network documentation that includes high-level and logical diagrams as well as device settings for critical systems and network equipment. It also addresses segmentation, dedicated management networks, device hardening, and logging of security-relevant events, including configuration changes.

No single configuration file proves all of that.

Assurance comes from reconciling intent, implementation, and effective state across the devices that jointly create the control.

Build a Configuration Evidence Model

An environment-wide review needs more than a larger pile of device reports. It needs a model that preserves the relationships among assets, settings, policies, and exceptions.

A practical configuration evidence model has five views.

1. Inventory view: What is represented?

Identify the devices, applications, virtual appliances, cloud controls, and other components included in the evidence set. Record product families, versions, roles, locations, owners, and collection dates.

The purpose is not to claim that configuration collection replaces every asset-discovery mechanism. It is to make the assessment boundary explicit and expose gaps between the systems the organization believes it has and the configurations it can actually produce.

2. Baseline view: What should be true?

Map relevant settings to vendor guidance, industry benchmarks, regulatory requirements, organizational standards, and documented operating needs.

A baseline should not become a blind checklist. Some deviations are necessary. Some settings have different meanings across products. Some security recommendations conflict with availability, safety, or support constraints. The assessment should preserve those conditions rather than flattening them into a generic pass or fail.

3. Relationship view: What does the environment allow?

Model the connections and dependencies that individual reviews tend to miss:

Which routes and rules create paths between trust zones?
Which systems can reach administrative interfaces?
Which authentication, logging, time, DNS, and update services are trusted?
Where do vendor access paths enter?
Are segmentation controls consistent across every device that implements the boundary?
Do cloud, wireless, remote-access, and legacy paths preserve the same assumptions?

This is where configuration data becomes architecture evidence.

4. Exception view: Why is the deviation present?

Every material deviation should have an owner, business reason, affected scope, compensating control, approval, and review or expiration date.

Without that context, the assessor cannot distinguish a consciously accepted operating requirement from drift, error, or forgotten emergency access. A technically accurate report can still produce poor decisions if it treats every difference as equivalent.

5. Trend view: Is the control getting stronger?

Retain enough continuity to compare assessments over time.

Leaders should be able to see whether high-risk deviations are being removed, whether the same root causes recur, whether one product family or business unit is falling behind, and whether remediation is producing greater control consistency.

A point-in-time result answers, “What did we find?”

A trend answers, “Are we learning?”

Look for Patterns, Not Just Findings

The value of environment-wide analysis is not that it generates more findings.

It is that it can reveal which findings share a cause.

Twenty devices using an obsolete protocol may not represent twenty independent failures. They may point to one outdated standard, one unsupported management tool, one inherited template, or one team that never received the replacement process.

Inconsistent logging destinations may reveal that an acquisition was never integrated into the monitoring model. Repeated access-control exceptions may show that an application architecture depends on flows the segmentation design did not anticipate. Different authentication sources may indicate that administrative identity has fragmented across regions or product generations.

This changes remediation.

Instead of distributing a long list of device-specific corrections, the organization can address the common mechanism: update the standard, replace the template, redesign the path, migrate the dependency, retire the exception process, or assign ownership for the control.

The result is not merely cleaner configurations. It is a more governable system.

Passive Analysis Matters When Touching the Environment Adds Risk

Active discovery and validation remain important. They can reveal live services, reachable paths, unmanaged assets, and runtime behavior that stored configurations do not show.

They are not always the safest first step.

Operational technology, critical infrastructure, legacy equipment, and fragile high-availability systems may impose strong constraints on scanning, agents, appliances, change windows, and test traffic. NIST’s Guide to Operational Technology Security emphasizes that OT security measures must account for performance, reliability, and safety requirements.

Offline analysis of existing configuration evidence can reduce the need to introduce new software or traffic merely to begin understanding the environment. It can help teams identify likely problems, missing evidence, and validation priorities before selecting the safest live tests.

That does not make offline analysis omniscient.

A configuration may be stale. A device may not be represented. Runtime state may differ from the saved file. A rule may exist but never be exercised. An undocumented path may not appear in the collected data. Configuration evidence should therefore guide targeted validation, not eliminate it.

The safer model is complementary:

Analyze the configuration evidence.
Identify systemic risks and uncertain relationships.
Prioritize the live checks that would resolve the most consequential uncertainty.
Reconcile the observed state with the model.
Preserve the updated evidence for the next review.

Where MachineTruth Fits

MachineTruth™ is MicroSolved’s Analytics as a Service platform for offline, passive device and network analysis.

The service can analyze configuration files and supporting network data to help inventory and map environments, compare settings with standards and best practices, examine routing and trust relationships, support segmentation analysis, identify hardening opportunities, and produce documentation for technical and assurance audiences.

Its most important contribution is scale with context.

MachineTruth allows the assessment to look across products, vendors, versions, locations, and business units while MicroSolved analysts validate findings, account for operating constraints, and translate patterns into prioritized mitigation guidance. Multi-year work can preserve organizational standards, accepted risks, reporting preferences, and trends so that later reviews begin with accumulated knowledge rather than a blank checklist.

MachineTruth does not replace asset discovery, live validation, change control, vulnerability management, architecture ownership, or engineering judgment.

It gives those activities a stronger evidence base by answering a question they often struggle to answer:

What security state do the collected configurations create when we analyze the environment as a whole?

Measure Configuration Assurance, Not Review Volume

Counting reviewed devices is useful for scope management. It is not enough to show that the control is improving.

More useful measures include:

Percentage of in-scope systems with a current configuration represented in the evidence set.
Percentage of critical controls mapped to both an approved baseline and implementation evidence.
Number of material cross-device inconsistencies by control domain.
Percentage of deviations with an owner, rationale, compensating control, and review date.
Age of high-risk configuration drift.
Recurrence rate for findings tied to the same template, standard, or process.
Percentage of high-consequence network zones whose segmentation is supported by current configuration evidence and targeted validation.
Time required to explain an allowed path from source to destination across the relevant controls.
Improvement in control consistency between assessment cycles.

One metric is especially revealing:

How long does it take to prove that the network currently enforces the boundary shown on the diagram?

If the answer requires several teams, multiple consoles, undocumented assumptions, and the memory of one experienced engineer, the organization has architecture knowledge but weak architecture evidence.

What Security Leaders Should Do This Week

Choose one high-consequence network zone, service, or business process.

Name the intended boundary. Identify what the zone protects, which communications should be allowed, which should be denied, and which teams own the decision.
Collect current evidence. Obtain the relevant firewall, router, switch, VPN, wireless, cloud, DNS, authentication, and logging configurations using an approved secure process.
Declare the assessment boundary. Record what is present, what is missing, how current the data is, and which runtime questions configuration evidence cannot answer.
Compare across the environment. Look for inconsistent management access, authentication sources, logging destinations, insecure services, unsupported versions, stale rules, and alternate routes.
Test the relationships. Confirm that the combined configurations enforce the intended segmentation and trust model.
Explain every exception. Require an owner, business reason, compensating control, and expiration or review date.
Fix the common causes first. Prioritize templates, standards, tools, and processes that can remove the same weakness from many systems.
Preserve the baseline. Retain the result so the next review can measure drift and improvement rather than starting over.

A network diagram is an important expression of intent.

A device checklist is an important test of local configuration.

Neither, by itself, proves the effective security state of the environment.

The network is created by the way configurations interact.

Review it that way.

Put MachineTruth to Work on Your Environment

MicroSolved, Inc. can help organizations use MachineTruth Global Configuration Assessments to:

Analyze device and application configurations at enterprise scale.
Reconcile network documentation with collected configuration evidence.
Identify systemic hardening, authentication, logging, routing, and access-control issues.
Evaluate segmentation and trusted relationships across mixed-vendor environments.
Prioritize root-cause remediation instead of distributing disconnected findings.
Preserve accepted risks, organizational standards, and improvement trends across assessment cycles.
Plan targeted validation for critical, sensitive, and operational technology environments.

To discuss a MachineTruth assessment, contact MicroSolved at info@microsolved.com or +1.614.351.1237.

Relax. We’re on watch.

AI tools were used as a research assistant for this content, but human moderation and writing are also included.

Authentication Is Not the Finish Line: Secure the Token Lifecycle

Posted on September 21, 2026 by Brent Huston

A user signs in with a passkey. The authentication is phishing-resistant. The identity provider records a successful challenge. Every dashboard says the login worked as designed.

Hours later, an attacker reuses a stolen session token.

No password is entered. No push notification appears. No new authentication ceremony occurs. The application sees a valid artifact and accepts it.

Both facts can be true at the same time: the authentication was strong, and the session was compromised.

That is the identity problem security programs need to address next.

Passkeys, hardware security keys, conditional access, and stronger account recovery are essential. They protect the process of establishing identity. But modern applications rarely ask a person or workload to prove identity again for every action. They rely on tokens and assertions that carry the result of an earlier decision across applications, APIs, clouds, and sessions.

The security boundary therefore does not end at login. It moves with the token.

NIST and CISA made that point operational in the final September 2026 release of NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse. The report addresses the keys that create trust, the systems that validate it, the lifetime of tokens, session monitoring, revocation, workload identity, and the division of responsibility between cloud providers and their customers.

The practical lesson is straightforward:

Treat every token as a live authorization decision, not as a receipt proving that authentication once succeeded.

Continue reading →

Three Field Guides for the Security Problems Showing Up Right Now

Posted on September 14, 2026 by Brent Huston

Over the last several months, we have released three longer-form guides around problems we keep seeing in real environments:

The Antifragile SOC Book
The AI Agents Management Framework
The Security Leader’s Operating System

They cover different areas, but they share a common theme: how to operate effectively as complexity, automation, and pressure increase.

Books

Why We Created These Materials

These guides did not begin as content projects.

They came from working problems.

Over the years, we have accumulated a lot of models, processes, questions, and operating approaches that we use when helping organizations solve difficult security problems. Some came from client work, some from research, and plenty came from lessons learned the hard way.

Much of that knowledge lived in conversations, notes, presentations, and experience.

We decided it was time to write more of it down.

Not as theory, and not as another collection of cybersecurity predictions.

As practical field material people can use, challenge, adapt, and apply.

Continue reading →

The Top Three Things Security Teams Need to Understand About AI-Driven Attacks

Posted on September 10, 2026 by Brent Huston

The easiest mistake security teams can make about AI-driven attacks is to imagine a completely new species of adversary.

That is not what most organizations are facing.

The objectives remain familiar: steal credentials, gain access, persist, move laterally, collect data, commit fraud, extort the victim, or conduct espionage. What AI changes is the economics of the attack. It reduces the time, expertise, and attention required to move from one step to the next.

That distinction matters because it tells defenders where to act.

Google Threat Intelligence Group reported this week that it has observed adversaries moving beyond basic prompting into agentic workflows and AI-enabled automation. In one Q2 2026 case, a threat actor used an AI coding chatbot and agent instructions to help plan, build, and execute a mass credential-harvesting campaign in less than six hours. The framework automated scanning, troubleshooting, and IP rotation with limited human involvement. (Google Threat Intelligence Group, September 8, 2026)

That does not mean every attacker has become an autonomous machine. It means the constraints that used to slow attackers down are weakening.

OnlineScammer

Security teams need to understand three things.

Continue reading →

When the Security Control Plane Fails: Build a Minimum Viable Defensive System

Posted on August 31, 2026 by Brent Huston

At 2:13 a.m., the SOC receives an alert involving a cloud administrator.

At 2:16, analysts lose access to the SIEM because authentication depends on the identity provider now under investigation.

At 2:19, the incident collaboration channel disappears.

At 2:23, the on-call engineer discovers that the break-glass credentials are stored in the privileged-access platform—which also authenticates through the suspect identity provider.

At 2:27, the cloud console still shows green status indicators, but nobody can establish whether the logs are complete, delayed, or manipulated.

By 2:35, the organization has two incidents.

The first is the security event.

The second is the loss of its ability to respond to the security event.

That second incident is the one most response plans do not adequately address.

Incident Response Has a Hidden Assumption

Continue reading →

Architecture Ages. Security Programs Should Plan for That

Posted on August 24, 2026 by Brent Huston

Every security architecture has an expiration date.

Most organizations simply do not know when it arrives.

An architecture may have been carefully designed, properly documented, and well defended when it was introduced. It reflected the business, technology, threat environment, and operational assumptions of its time.

Then the organization changed.

It adopted cloud services. It acquired another company. Employees became more distributed. Vendors received deeper access. Applications became API-driven. Automation expanded. AI entered business workflows. Identity became the connective tissue between systems that no longer shared a traditional perimeter.

The architecture did not suddenly fail.

It aged.

80sIBM

Continue reading →

The Hidden Cost of “Temporary” Security Exceptions

Posted on August 17, 2026 by Brent Huston

Nothing is more permanent than a temporary security exception.

The emergency administrator account created during a production outage remains active months later.

The firewall opening approved for a launch is never removed.

The vendor access granted for troubleshooting quietly becomes the normal support model.

The policy exception accepted until a legacy application is replaced survives three budget cycles.

None of these conditions usually begins with negligence.

They begin with urgency.

That is precisely why they are dangerous.

E compliance

Exceptions Are Designed for the Present

A security exception is a decision to tolerate a known weakness because another business need is temporarily more important.

That may be entirely reasonable.

Continue reading →

Stop Measuring Security Controls. Measure Decision Latency.

Posted on August 10, 2026 by Brent Huston

The attacker already made a decision.

Your organization is still scheduling the meeting.

For years, security programs have measured the presence and performance of controls. We count vulnerabilities, patching percentages, phishing failures, endpoint coverage, open findings, audit exceptions, and incident response times.

These metrics can be useful.

They can also create the illusion that security outcomes are primarily determined by control quality.

In many consequential events, the organization does not fail because it lacks information or technology.

It fails because it cannot make a confident decision quickly enough.

Cyberleader

Continue reading →

Security Debt Compounds Faster Than Technical Debt

Posted on August 3, 2026 by Brent Huston

Organizations rarely wake up insecure.

They slowly inherit yesterday’s exceptions.

A firewall rule is added to support an urgent launch. A service account is created for an integration that will supposedly be replaced next quarter. A vendor receives elevated access during troubleshooting. A legacy application remains connected because the migration became more difficult than expected.

Each decision appears manageable in isolation.

Over time, they begin to interact.

That is when security debt starts to compound.

Thinking

Security Debt Is More Than Unpatched Software

Technical debt generally refers to the future cost created when teams choose a faster or easier implementation today.

Continue reading →