Tag Archives: General InfoSec

Architecture Ages. Security Programs Should Plan for That

Posted on by
Reply

Every security architecture has an expiration date.

Most organizations simply do not know when it arrives.

An architecture may have been carefully designed, properly documented, and well defended when it was introduced. It reflected the business, technology, threat environment, and operational assumptions of its time.

Then the organization changed.

It adopted cloud services. It acquired another company. Employees became more distributed. Vendors received deeper access. Applications became API-driven. Automation expanded. AI entered business workflows. Identity became the connective tissue between systems that no longer shared a traditional perimeter.

The architecture did not suddenly fail.

It aged.

80sIBM

Continue reading →

The Hidden Cost of “Temporary” Security Exceptions

Posted on by
Reply

Nothing is more permanent than a temporary security exception.

The emergency administrator account created during a production outage remains active months later.

The firewall opening approved for a launch is never removed.

The vendor access granted for troubleshooting quietly becomes the normal support model.

The policy exception accepted until a legacy application is replaced survives three budget cycles.

None of these conditions usually begins with negligence.

They begin with urgency.

That is precisely why they are dangerous.

E compliance

Exceptions Are Designed for the Present

A security exception is a decision to tolerate a known weakness because another business need is temporarily more important.

That may be entirely reasonable.

Continue reading →

Stop Measuring Security Controls. Measure Decision Latency.

Posted on by
Reply

The attacker already made a decision.

Your organization is still scheduling the meeting.

For years, security programs have measured the presence and performance of controls. We count vulnerabilities, patching percentages, phishing failures, endpoint coverage, open findings, audit exceptions, and incident response times.

These metrics can be useful.

They can also create the illusion that security outcomes are primarily determined by control quality.

In many consequential events, the organization does not fail because it lacks information or technology.

It fails because it cannot make a confident decision quickly enough.

Cyberleader

Continue reading →

Security Debt Compounds Faster Than Technical Debt

Posted on by
Reply

Organizations rarely wake up insecure.

They slowly inherit yesterday’s exceptions.

A firewall rule is added to support an urgent launch. A service account is created for an integration that will supposedly be replaced next quarter. A vendor receives elevated access during troubleshooting. A legacy application remains connected because the migration became more difficult than expected.

Each decision appears manageable in isolation.

Over time, they begin to interact.

That is when security debt starts to compound.

Thinking

Security Debt Is More Than Unpatched Software

Technical debt generally refers to the future cost created when teams choose a faster or easier implementation today.

Continue reading →

Your Biggest Security Risk Might Be Organizational Complexity

Posted on by
Reply

Every security team adds tools to reduce risk.

A new endpoint platform closes a visibility gap. A cloud security product addresses configuration drift. An identity tool improves access governance. Another dashboard gives executives a consolidated view of the environment.

Individually, each decision makes sense.

Collectively, those decisions can create a security program that is difficult to understand, expensive to operate, and nearly impossible to change safely.

Eventually, the tools intended to reduce risk become part of the risk.

GenSec

Complexity Is an Attack Surface

We usually describe the attack surface in technical terms: exposed services, vulnerable applications, unmanaged devices, excessive privileges, and external dependencies.

But organizations also have an operational attack surface.

Continue reading →

Passkeys, Not Passcodes: A Practical Enterprise Guide to Moving Beyond Passwords

Posted on by
Reply

There is a small terminology problem in the identity world right now, and it matters more than it looks.

A passcode or PIN is usually a local unlock secret. It unlocks a phone, a laptop, Windows Hello, an authenticator app, or a hardware security key. A passkey is different. A passkey is the standards-based replacement for passwords, built on FIDO2/WebAuthn. The user unlocks the passkey locally with a fingerprint, face scan, device PIN, pattern, or security key, but the website or application receives cryptographic proof — not a reusable password. FIDO defines passkeys as FIDO authentication credentials based on FIDO standards, tied to an account, and used with the same process the user already uses to unlock a device.

That distinction is not pedantry. It is the difference between a local unlock method and a replacement for one of the most abused controls in the history of computing.

Passwords have had a long run. They also have had a long list of failures: reuse, phishing, spraying, stuffing, database theft, weak reset workflows, help desk abuse, and user fatigue. We have spent decades trying to compensate for those failures with complexity rules, expiration schedules, password managers, SMS codes, mobile push prompts, training campaigns, and detective controls.

Some of those helped. Some just moved the pain around.

Passkeys change the model.

Continue reading →

AI Agents Are Already Working for You. Who’s Managing Them?

Posted on by
Reply

AI Agents Are Not Applications. They Are Digital Workers.

Most organizations are adopting AI agents faster than they are learning how to govern them.

That is the problem.

A chatbot that answers questions is one thing. An AI agent that can access business data, use tools, trigger workflows, generate artifacts, make recommendations, or alter enterprise state is something else entirely.

At that point, the organization is no longer just deploying software.

It is introducing a new kind of operational actor.

That actor needs identity.

It needs boundaries.

It needs oversight.

It needs evidence.

It needs a human owner.

It needs a kill switch.

In other words, AI agents must be managed more like digital workers than ordinary applications.

AIAgentBanner

Continue reading →

Cyber Risk Is Enterprise Value Risk : A Practical Portfolio Approach for VC and PE Firms

Posted on by
Reply

For venture capital and private equity executives, cyber security is no longer just an IT issue. It is a valuation issue, a governance issue, a revenue issue, and a portfolio resilience issue.

GenSec

There was a time when cyber security could be treated as a technical matter.

It lived with the IT team. It showed up in diligence as a paragraph buried deep in a report. It became important only when a customer asked a hard question, a regulator came knocking, or something on the network caught fire.

That time is over.

For venture capital and private equity firms, cyber risk has become enterprise value risk. It affects valuation. It affects revenue quality. It affects debt, insurance, customer trust, regulatory posture, exit readiness, and the ability of management teams to execute without being pulled into avoidable chaos.

More importantly, cyber risk is no longer limited to the portfolio company.

The investment firm itself is a high-value target.

Deal flow, confidential financials, legal strategy, investment committee material, banking relationships, limited partner communications, M&A plans, board materials, and executive correspondence all create a concentration of sensitive information. Attackers understand this. So do regulators, insurers, strategic buyers, enterprise customers, and increasingly, boards.

The uncomfortable truth is this:

Many investment firms still manage cyber risk as a fragmented collection of one-off assessments, inconsistent vendor reports, annual questionnaires, and “we’ll fix it after close” assumptions.

That approach does not scale. It does not give partners a clear view of exposure. It does not give operating teams a consistent way to prioritize improvement. And it certainly does not create the kind of defensible evidence that boards, buyers, customers, and limited partners expect when the questions get serious.

MicroSolved’s value proposition for VC and PE firms is simple:

Help reduce cyber risk, protect enterprise value, and improve portfolio resilience through practical, expert-led security assurance that scales from the fund to the portfolio.

That sounds like a mouthful, so let’s unpack it.

Continue reading →

CaneCorso™ and the Real Problems AI Is Creating for the Business

Posted on by
Reply

AI didn’t sneak into the enterprise.

It walked in through productivity.

Email triage. Document handling. Support workflows. Internal copilots. Retrieval systems. Early agentic use cases. All of it made sense at the time. All of it still does.

But something changed along the way.

We didn’t just adopt AI—we embedded it into workflows that can influence decisions, expose data, and take action.

That’s where the problem starts.

And it’s exactly where CaneCorso™ is designed to operate.

CaneCorsoAI

AI Risk Isn’t a Model Problem — It’s a Workflow Problem

There’s a persistent misunderstanding in the market right now.

Most conversations about AI security still center on the model—what it knows, how it behaves, whether it can be tricked.

That’s not where the real risk lives.

The real risk shows up when:

  • Untrusted content enters a workflow
  • That workflow uses AI to interpret or transform it
  • And the output influences business operations

That content might come from:

  • Email
  • Documents
  • OCR pipelines
  • Retrieved knowledge (RAG)
  • Support tickets
  • External data sources

Once it’s in the workflow, it’s no longer just data.

It’s influence.

CaneCorso™ exists to control that influence—before it becomes an operational problem.

Continue reading →

Update on PromptDefense Suite and AI Security Research

Posted on by
Reply

Last week, I discussed why and some of how we built the new PromptDefense Suite. 

This week, we are discussing the product’s future internally and how we might go to market. This is mainly due to two new capabilities we have built into the product. 

The first is an API and workflow automation mechanism. This allows organizations to stand up a single instance of PromptDefense and then use it to protect multiple AI/agent workflows. The code no longer has to be embedded directly in the project; instead, all defensive capabilities and logging can be accessed via an API instance. The API is robust and supports API key restrictions that tie into a rules engine, so that different workflows can have different trust models and actions pre-assigned in an audit-friendly way. 

Secondly, we have developed a licensing mechanism that covers protected workflows and skips the per-seat, per-token models that seemed too confusing for most firms looking for these kinds of tools. They told us they wanted a simpler licensing approach, and we developed a new licensing mechanism to make it easy, manageable, and auditable. Our testers have been calling it a win! 

As we continue with the beta-testing process and lock down our decisions about where the product is going, the news that drove us to create it continues to flow in. More of our clients are working on agents and AI-integrated workflows, which require this level of protection. While we continue to develop PromptDefender, we are also working to develop and release extended frameworks for AI model, agent, and product management, along with policies, procedures, and vendor risk assessment tools for these frameworks, for our vCISO clients. We’re also busy researching ongoing compliance implementation for AI workflows and agents, and should have more on that shortly. 

In the meantime, if you want to discuss AI or agent security, risk management, or other relevant topics, please reach out. We would love to talk with you and help align our modernization capabilities with your emerging needs. You can always email us at info@microsolved.com or call us at +1-614-351-1237. 

As always, thanks for reading. Stay safe out there, and stay tuned for more updates.