Cyber Risk Is Enterprise Value Risk : A Practical Portfolio Approach for VC and PE Firms

Posted on April 27, 2026 by Brent Huston

For venture capital and private equity executives, cyber security is no longer just an IT issue. It is a valuation issue, a governance issue, a revenue issue, and a portfolio resilience issue.

GenSec

There was a time when cyber security could be treated as a technical matter.

It lived with the IT team. It showed up in diligence as a paragraph buried deep in a report. It became important only when a customer asked a hard question, a regulator came knocking, or something on the network caught fire.

That time is over.

For venture capital and private equity firms, cyber risk has become enterprise value risk. It affects valuation. It affects revenue quality. It affects debt, insurance, customer trust, regulatory posture, exit readiness, and the ability of management teams to execute without being pulled into avoidable chaos.

More importantly, cyber risk is no longer limited to the portfolio company.

The investment firm itself is a high-value target.

Deal flow, confidential financials, legal strategy, investment committee material, banking relationships, limited partner communications, M&A plans, board materials, and executive correspondence all create a concentration of sensitive information. Attackers understand this. So do regulators, insurers, strategic buyers, enterprise customers, and increasingly, boards.

The uncomfortable truth is this:

Many investment firms still manage cyber risk as a fragmented collection of one-off assessments, inconsistent vendor reports, annual questionnaires, and “we’ll fix it after close” assumptions.

That approach does not scale. It does not give partners a clear view of exposure. It does not give operating teams a consistent way to prioritize improvement. And it certainly does not create the kind of defensible evidence that boards, buyers, customers, and limited partners expect when the questions get serious.

MicroSolved’s value proposition for VC and PE firms is simple:

Help reduce cyber risk, protect enterprise value, and improve portfolio resilience through practical, expert-led security assurance that scales from the fund to the portfolio.

That sounds like a mouthful, so let’s unpack it.

The Investment Firm Has Its Own Attack Surface

Before we talk about portfolio-wide programs, we should start with the firm itself.

VC and PE firms are not just financial organizations. They are information aggregators. They hold the kind of information that criminals, competitors, and nation-state actors would love to access.

They know what companies are raising.

They know what deals are active.

They know which assets are under pressure.

They know who is negotiating, who is selling, who is buying, and what the numbers look like.

Yet many firms are intentionally lean. They are not built to operate large internal security organizations. Partners, associates, operating partners, finance teams, and administrative staff often work across a mix of cloud platforms, personal devices, travel networks, collaboration tools, mobile apps, outsourced IT providers, and boutique SaaS platforms.

That operating model is fast, flexible, and relationship-driven.

It is also exposed.

MicroSolved helps investment firms build a defensible cyber risk posture without forcing them to become something they are not. That means assessing the firm’s own controls, validating external exposure, reviewing identity and access practices, examining cloud and collaboration platforms, testing incident response readiness, and helping leadership understand the firm’s risk in plain business language.

This matters because a fund-level incident is not just an IT problem.

It can become:

A reputation problem.
An LP confidence problem.
A deal execution problem.
A legal problem.
A wire fraud problem.
A board problem.

A compromised partner mailbox can expose negotiations. A breached data room can affect a transaction. A stolen credential can open the door to payment fraud. A weak vendor can become an unexpected path into sensitive firm operations.

Security at the firm level is not about buying every tool on the market.

It is about understanding the handful of places where the firm is most exposed and tightening them before someone else finds them first.

Cyber Diligence Should Find Risk Before It Becomes Yours

Most investment professionals are comfortable with financial diligence, legal diligence, market diligence, and operational diligence.

Cyber diligence, however, is still too often treated as optional, late-stage, or highly variable.

That is a mistake.

Cyber risk can hide in the places that matter most to valuation: revenue concentration, enterprise customer expectations, intellectual property protection, regulatory obligations, cloud architecture, software development practices, third-party dependencies, identity management, backup resilience, and the ability to recover from an incident.

For a growth-stage SaaS company, weak security practices may slow enterprise sales.

For a healthcare platform, poor controls may create regulatory and contractual exposure.

For a manufacturer, a ransomware event may interrupt production and cash flow.

For a fintech company, a weak security posture may directly threaten trust, licensing, and partnership opportunities.

For a portfolio company preparing for exit, missing security evidence can create friction with strategic buyers, delay close, or create downward pressure during negotiations.

Cyber diligence does not need to become a months-long science project.

It does need to be real.

MicroSolved can help firms evaluate cyber risk before investment by performing focused, risk-based assessments designed for transaction timelines. The goal is not to create a theoretical perfect score. The goal is to answer the questions that matter to investors:

What are we buying?
Where is the company most exposed?
Could this risk affect revenue, operations, valuation, or exit?
What must be fixed immediately?
What can be handled in the post-close value creation plan?
What evidence exists to support management’s claims?

That kind of diligence creates leverage.

It gives deal teams a more complete understanding of risk. It gives operating partners a practical roadmap. It gives the board something more useful than a red-yellow-green slide. And, in some cases, it may reveal that the cyber risk is not priced into the deal.

That is exactly the point.

Portfolio-Wide Visibility Beats One-Off Firefighting

The biggest challenge for VC and PE firms is not that they have one company with cyber risk.

It is that they have many companies with different levels of maturity, different technologies, different budgets, different customer expectations, and different leadership attitudes toward security.

One company may have a mature security program and a capable CISO.

Another may have a lean engineering team and no dedicated security staff.

Another may have inherited technical debt from acquisitions.

Another may be racing to satisfy customer security questionnaires while quietly hoping no one asks for proof.

Another may have cyber insurance requirements it barely understands.

Without a standardized approach, portfolio cyber risk becomes anecdotal. The loudest incident gets attention. The squeakiest management team gets help. The companies closest to exit get a scramble of activity. Meanwhile, the rest of the portfolio may remain largely invisible.

That is not a strategy.

It is a reaction pattern.

MicroSolved helps firms implement a blanket approach across the portfolio. That does not mean every company receives the same checklist or the same controls regardless of size, sector, or risk.

It means the firm creates:

A consistent language.
A repeatable assessment model.
A practical way to compare cyber risk across companies.
A method to prioritize remediation based on business impact.

That consistency is powerful.

It allows investors and operating partners to see where risk is concentrated. It helps identify which companies need immediate remediation, which ones need strategic security leadership, which ones are ready for deeper technical testing, and which ones simply need practical policy, process, and evidence building.

A portfolio-wide approach also helps management teams.

Instead of being left to interpret vague investor concern, they receive specific findings, prioritized actions, and access to experienced practitioners who can help them move from:

“We know this is important.”

to:

“Here is what we are doing next.”

For VC and PE executives, the question is not whether every portfolio company should become a security powerhouse.

They should not.

The better question is whether each company has the right level of security for its business model, threat profile, customer expectations, regulatory obligations, and stage of growth.

That is a much more useful conversation.

The Board Needs Better Cyber Signals

Boards are increasingly expected to provide oversight of cyber risk.

But many board conversations still suffer from the same problem: they are either too technical or too shallow.

A dashboard full of vulnerability counts may not tell the board what really matters. A statement that “we passed our security assessment” may not provide enough detail to support meaningful oversight. A management update that says “we are improving security” may be true, but not actionable.

Board members and investors need signals that connect cyber risk to business outcomes.

The useful questions sound more like this:

Can the company recover from ransomware without paying?
Are the most sensitive systems protected by strong identity controls?
Is customer data appropriately segmented and monitored?
Does the company know its critical vendors?
Are backups tested?
Are software releases being reviewed for security risk?
Are security commitments in customer contracts actually being met?
Is the company ready for a buyer’s security diligence process?

These are not abstract technical questions.

They are governance questions.

They are revenue questions.

They are valuation questions.

MicroSolved’s role is to turn technical findings into executive-level visibility. That means translating assessment data into risk themes, business impact, remediation priorities, and board-ready reporting. It also means helping leadership distinguish between noise and material exposure.

Not every vulnerability is a crisis.

Not every missing policy is a disaster.

Not every scary headline applies to every company.

But some weaknesses really do matter, and they need to be understood at the right level.

Good cyber reporting should help executives decide.

It should not just make them anxious.

Customer Trust Is Now a Growth Constraint

For many portfolio companies, especially in technology, healthcare, financial services, manufacturing, logistics, and B2B services, security has become part of the sales process.

Enterprise customers want evidence.

They ask for SOC 2 reports, penetration test summaries, policies, incident response plans, vendor management practices, secure development lifecycle documentation, insurance coverage, and proof that controls are not merely aspirational.

Procurement teams have become more sophisticated. Security questionnaires have become longer. Contractual requirements have become more demanding.

For early-stage companies, this can feel like a distraction.

For growth-stage companies, it can become a bottleneck.

For companies nearing exit, it can become a material diligence issue.

There is a simple reality here:

A company that cannot answer customer security questions may struggle to close larger deals.

A company that gives poor answers may create trust concerns.

A company that overstates its capabilities may create future legal exposure.

MicroSolved can help portfolio companies build the kind of practical security evidence that supports growth. That might include penetration testing, vulnerability assessment, policy development, incident response planning, executive tabletop exercises, third-party risk review, compliance readiness, or advisory support for customer security inquiries.

The aim is not bureaucracy.

The aim is sales enablement through credible security.

For investors, that matters. If security friction delays revenue, then security is not a back-office issue.

It is a growth issue.

If security credibility helps a company win enterprise customers, then security becomes part of the value creation story.

That is the mindset shift.

Exit Readiness Starts Earlier Than Most Firms Think

Too many companies treat security as an exit-readiness task that begins when the banker is already involved.

By then, the window for thoughtful improvement may be narrow.

Strategic buyers and sophisticated acquirers increasingly examine cyber risk as part of due diligence. They want to understand the company’s data exposure, history of incidents, security controls, technology architecture, software practices, regulatory obligations, and ability to integrate safely.

Weaknesses may not kill a deal, but they can create friction.

They can create escrow demands.

They can create indemnity concerns.

They can delay timelines.

They can create valuation pressure.

The problem is that real security maturity cannot be faked in a week.

Policies can be written quickly. Evidence cannot. A penetration test can be scheduled quickly. Remediation takes time. A security roadmap can be drafted quickly. Operational habits take longer. An incident response plan can be produced quickly. Practicing it is another matter.

MicroSolved’s portfolio approach helps companies build toward exit over time. That means identifying gaps early, prioritizing fixes that matter, documenting progress, and creating a trail of evidence that can withstand scrutiny.

For a VC or PE firm, this is simply disciplined value protection.

You would not wait until exit to understand financial controls, customer concentration, legal exposure, or management depth.

Cyber deserves the same treatment.

The earlier the firm builds visibility, the more options it has.

The Right Partner Matters

Cyber security is full of vendors selling dashboards, platforms, scoring systems, managed services, compliance packages, and automated reports.

Some of those offerings are useful.

Some are not.

Most are incomplete without judgment.

VC and PE firms need a partner that understands both the technical side of security and the business context of investment. The work requires more than scanning tools. It requires experience, prioritization, discretion, executive communication, and the ability to operate across different company sizes and maturity levels.

MicroSolved brings that practical blend: hands-on security testing, risk assessment, advisory support, incident readiness, and executive reporting.

The value is not just in finding problems.

Plenty of tools can find problems.

The value is in identifying which problems matter, explaining why they matter, and helping teams reduce risk in a way that fits the business.

That last part is important.

A 40-person SaaS company does not need the same security program as a global financial institution. A founder-led healthcare technology company may need focused help on customer evidence, HIPAA-related safeguards, and cloud configuration. A manufacturer may need operational technology awareness, ransomware resilience, and backup testing. A platform company pursuing acquisitions may need repeatable cyber diligence for targets. A mature portfolio company heading toward exit may need stronger documentation, technical validation, and board-level reporting.

One-size-fits-all security advice is usually bad advice.

The right approach is risk-based, business-aware, and practical enough to survive contact with reality.

What a Practical VC/PE Cyber Program Can Look Like

A strong program does not have to be overly complex.

In fact, the simpler and more repeatable it is, the more likely it is to work.

At the Fund Level

The firm should understand its own exposure.

That includes identity and access management, email security, cloud collaboration tools, data handling, vendor risk, executive devices, incident response, and wire fraud controls.

The firm should know how it would respond if a partner account were compromised, if sensitive deal material were exposed, or if a vendor incident affected operations.

At the Deal Level

Cyber diligence should be scaled to the transaction.

Not every deal requires the same depth, but every deal should have a way to identify material cyber risk. That may include external exposure review, architecture review, policy and control assessment, cloud posture checks, vulnerability testing, software security review, or executive interviews.

At the Portfolio Level

Each company should be assessed using a consistent framework that produces comparable results.

Findings should be prioritized.

Remediation should be tracked.

Board reporting should focus on business impact and progress, not technical clutter.

At the Value Creation Level

Portfolio companies should receive practical help.

That may mean remediation guidance, security roadmap development, incident response planning, tabletop exercises, compliance readiness, customer security support, or periodic technical testing.

At the Exit Level

Companies should be prepared with evidence.

They should know what a buyer will ask, where the gaps remain, what has been improved, and how to explain the security posture honestly and confidently.

That is not an academic model.

It is a workable operating rhythm.

The Conversation Investors Should Be Having Now

For partners, operating executives, and board members, the conversation should move beyond:

“Are we secure?”

That question is too broad to be useful.

The better questions are:

Where could cyber risk affect enterprise value?
Which portfolio companies have the most material exposure?
Which risks are likely to affect revenue, operations, compliance, or exit?
What evidence do we have?
What is being remediated?
Who owns the risk?
How would we respond to an incident tomorrow morning?
Where do we need expert help?

Those questions create movement.

They also create accountability.

Cyber risk is not going away. The threat landscape will keep changing. Regulatory expectations will keep rising. Customer demands will keep expanding. Attackers will keep looking for leverage.

The firms that win will be the ones that build repeatable ways to see, measure, and reduce risk before it becomes a crisis.

Why MicroSolved

The reason to use MicroSolved is not because cyber risk can be eliminated.

It cannot.

The reason is that cyber risk can be made visible, prioritized, and managed.

For the firm itself, that means a defensible posture around sensitive investment operations, confidential data, executive communications, incident readiness, and fraud prevention.

For the portfolio, it means a blanket, standardized approach that creates common language, comparable metrics, faster remediation, better board visibility, and stronger exit preparation.

For management teams, it means practical guidance instead of abstract fear.

For investors, it means knowing that cyber risk is being managed, not merely discussed.

Closing Thought

VC and PE firms are very good at identifying value, shaping strategy, and driving operating improvement.

Cyber security should be treated as part of that discipline.

Not as a side project.

Not as a compliance afterthought.

Not as something delegated entirely to IT.

The firms that do this well will not be the ones that buy the most tools or demand the longest questionnaires. They will be the ones that build repeatable, evidence-based, business-aligned security practices into the investment lifecycle.

That is the work.

Cyber risk is now enterprise value risk. Handle it with the same seriousness, consistency, and executive attention that you bring to every other driver of value.

Get In Touch

For more information, or for a discussion of how we can help, just email us at info@microsolved.com or give us a call at +1.614.351.1237 today. We look forward to putting our 30+ years of experience to work for you!

CaneCorso™ and the Real Problems AI Is Creating for the Business

Posted on April 22, 2026 by Brent Huston

AI didn’t sneak into the enterprise.

It walked in through productivity.

Email triage. Document handling. Support workflows. Internal copilots. Retrieval systems. Early agentic use cases. All of it made sense at the time. All of it still does.

But something changed along the way.

We didn’t just adopt AI—we embedded it into workflows that can influence decisions, expose data, and take action.

That’s where the problem starts.

And it’s exactly where CaneCorso™ is designed to operate.

CaneCorsoAI

AI Risk Isn’t a Model Problem — It’s a Workflow Problem

There’s a persistent misunderstanding in the market right now.

Most conversations about AI security still center on the model—what it knows, how it behaves, whether it can be tricked.

That’s not where the real risk lives.

The real risk shows up when:

Untrusted content enters a workflow
That workflow uses AI to interpret or transform it
And the output influences business operations

That content might come from:

Email
Documents
OCR pipelines
Retrieved knowledge (RAG)
Support tickets
External data sources

Once it’s in the workflow, it’s no longer just data.

It’s influence.

CaneCorso™ exists to control that influence—before it becomes an operational problem.

The Perimeter Moved — Most Organizations Didn’t

Traditional security models assume boundaries.

Applications. Networks. Endpoints. Users.

AI workflows don’t respect those boundaries.

They collapse:

Data
Instructions
Context
Intent

…into the same channel.

That creates an entirely different risk profile:

Prompt injection (direct and indirect)
Data exfiltration through prompt manipulation
RAG poisoning and retrieval contamination
Multimodal attacks through documents and images
Unsafe tool usage triggered by manipulated inputs

These are not theoretical edge cases.

They are natural outcomes of how AI is being used today.

CaneCorso™ addresses this by acting as a shared AI Application Firewall—a control layer that sits in front of real workflows, not just models.

Small Businesses: The Problem Is Safe Adoption

Small organizations aren’t trying to solve AI security academically.

They’re trying to use AI without breaking the business.

They typically don’t have:

Dedicated AI security engineering
Time to build custom controls
Resources to continuously test workflows

But they still face the same risks.

For them, the core problem is simple:

How do we use AI without creating exposure we don’t understand?

CaneCorso™ answers that by providing:

A reusable control layer
Business-safe handling decisions (allow, sanitize, tokenize, block)
Protection against injection and data leakage
Minimal disruption to workflow performance

The goal isn’t perfection.

It’s safe, practical adoption.

Mid-Size Organizations: The Problem Is Inconsistency

Mid-market firms hit a different wall.

AI use spreads quickly—but control does not.

You end up with:

One team securing prompts one way
Another team building ad hoc filters
A third team doing nothing at all

What looks like progress is actually fragmentation.

And fragmentation creates risk.

Because now:

Policies are inconsistent
Logging is inconsistent
Enforcement is inconsistent
Assurance is impossible

CaneCorso™ solves this by introducing a single control plane across workflows.

Not by replacing tools.

But by normalizing how risk is handled across:

Inputs
Prompts
Retrieved data
Outputs

That shift—from local fixes to shared control—is what enables real governance.

Enterprise: The Problem Is Scale and Assurance

Enterprises don’t struggle with whether to use AI.

They struggle with using it at scale without losing control.

The complexity shows up quickly:

More workflows
More data sources
More sensitive content
More downstream impact

Risk concentrates in places like:

Document ingestion pipelines
Retrieval systems
Internal copilots
Agent-driven workflows
Tool-connected AI systems

At that scale, the question changes.

It’s no longer:

“Are we protected?”

It becomes:

“Can we prove we are operating safely?”

CaneCorso™ addresses both sides:

Centralized protection across workflows
Measurable assurance through testing and auditable decisions

Because at enterprise scale, security without evidence is just opinion.

The Difference: Protect the Workflow Without Breaking It

This is where most approaches fail.

Traditional security thinking leans toward blocking.

If something looks suspicious, stop it.

That works—until it breaks the business.

AI workflows are different.

They require more nuance.

CaneCorso™ is built around that reality:

Allow when safe
Sanitize when needed
Tokenize when privacy matters
Block when necessary

That model matters.

Because the goal is not to stop work.

The goal is to keep safe work moving.

The Reality Behind the Threats

It’s easy to focus on the technical attacks:

Prompt injection
Indirect injection
Data exfiltration attempts
RAG poisoning
Tool abuse

But in practice, those attacks succeed because of how systems are built and used.

Developers concatenate untrusted input into prompts
Teams trust retrieved content without validation
Users paste sensitive data into workflows
Agent permissions expand faster than controls
Deployments happen without adversarial testing

These are normal behaviors.

CaneCorso™ works because it assumes those realities—not ideal conditions.

What Actually Changes

When organizations put a control layer like CaneCorso™ in place, the impact is operational.

Not theoretical.

You see:

Reduced likelihood of avoidable AI-driven incidents
Less sensitive data leakage
Fewer workflow failures from brittle controls
Faster, safer AI adoption
A clearer story for auditors, customers, and leadership

That last point matters more than most people realize.

Because AI isn’t just a technology decision anymore.

It’s a business trust decision.

Final Thoughts: Rational AI Security

There are two bad approaches to AI right now.

Move fast and ignore the risk.

Or lock everything down and lose the value.

Neither works.

What organizations actually need is a rational approach:

Small businesses need safe adoption
Mid-size businesses need consistency
Enterprises need scale and assurance

CaneCorso™ aligns with that reality.

Not by trying to “solve AI.”

But by solving the actual problem:

controlling how untrusted content influences real business workflows.

That’s the shift.

And it’s where AI security either becomes operational—or irrelevant.

More Info

To learn more, just give us a call at +1.614.351.1237, or drop us a line at info@microsolved.com. We’d love to walk you through how CaneCorso can help you secure the AI future of your business!

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Update on PromptDefense Suite and AI Security Research

Posted on March 23, 2026 by Brent Huston

Last week, I discussed why and some of how we built the new PromptDefense Suite.

This week, we are discussing the product’s future internally and how we might go to market. This is mainly due to two new capabilities we have built into the product.

The first is an API and workflow automation mechanism. This allows organizations to stand up a single instance of PromptDefense and then use it to protect multiple AI/agent workflows. The code no longer has to be embedded directly in the project; instead, all defensive capabilities and logging can be accessed via an API instance. The API is robust and supports API key restrictions that tie into a rules engine, so that different workflows can have different trust models and actions pre-assigned in an audit-friendly way.

Secondly, we have developed a licensing mechanism that covers protected workflows and skips the per-seat, per-token models that seemed too confusing for most firms looking for these kinds of tools. They told us they wanted a simpler licensing approach, and we developed a new licensing mechanism to make it easy, manageable, and auditable. Our testers have been calling it a win!

As we continue with the beta-testing process and lock down our decisions about where the product is going, the news that drove us to create it continues to flow in. More of our clients are working on agents and AI-integrated workflows, which require this level of protection. While we continue to develop PromptDefender, we are also working to develop and release extended frameworks for AI model, agent, and product management, along with policies, procedures, and vendor risk assessment tools for these frameworks, for our vCISO clients. We’re also busy researching ongoing compliance implementation for AI workflows and agents, and should have more on that shortly.

In the meantime, if you want to discuss AI or agent security, risk management, or other relevant topics, please reach out. We would love to talk with you and help align our modernization capabilities with your emerging needs. You can always email us at info@microsolved.com or call us at +1-614-351-1237.

As always, thanks for reading. Stay safe out there, and stay tuned for more updates.

AI in Cyber Defense: What Works Today vs. What’s Hype

Posted on January 28, 2026 by Brent Huston

Practical Deployment Paths

Artificial Intelligence is no longer a futuristic buzzword in cybersecurity — it’s here, and defenders are being pressured on all sides: vendors pushing “AI‑enabled everything,” adversaries weaponizing generative models, and security teams trying to sort signal from noise. But the truth matters: mature security teams need clarity, realism, and practicable steps, not marketing claims or theoretical whitepapers that never leave the lab.

The Pain Point: Noise > Signal

Security teams are drowning in bold AI vendor claims, inflated promises of autonomous SOCs, and feature lists that promise effortless detection, response, and orchestration. Yet:

Budgets are tight.
Societies face increasing threats.
Teams lack measurable ROI from expensive, under‑deployed proof‑of‑concepts.

What’s missing is a clear taxonomy of what actually works today — and how to implement it in a way that yields measurable value, with metrics security leaders can trust.

AISecImage

The Reality Check: AI Works — But Not Magically

It’s useful to start with a grounding observation: AI isn’t a magic wand.
When applied properly, it does elevate security outcomes, but only with purposeful integration into existing workflows.

Across the industry, practical AI applications today fall into a few consistent categories where benefits are real and demonstrable:

1. Detection and Triage

AI and machine learning are excellent at analyzing massive datasets to identify patterns and anomalies across logs, endpoint telemetry, and network traffic — far outperforming manual review at scale. This reduces alert noise and helps prioritize real threats.

Practical deployment path:

Integrate AI‑enhanced analytics into your SIEM/XDR.
Focus first on anomaly detection and false‑positive reduction — not instant response automation.

Success metrics to track:

False positive rate reduction
Mean Time to Detect (MTTD)

2. Automated Triage & Enrichment

AI can enrich alerts with contextual data (asset criticality, identity context, threat intelligence) and triage them so analysts spend time on real incidents.

Practical deployment path:

Connect your AI engine to log sources and enrichment feeds.
Start with automated triage and enrichment before automation of response.

Success metrics to track:

Alerts escalated vs alerts suppressed
Analyst workload reduction

3. Accelerated Incident Response Workflows

AI can power playbooks that automate parts of incident handling — not the entire response — such as containment, enrichment, or scripted remediation tasks.

Practical deployment path:

Build modular SOAR playbooks that call AI models for specific tasks, not full control.
Always keep a human‑in‑the‑loop for high‑impact decisions.

Success metrics to track:

Reduced Mean Time to Respond (MTTR)
Accuracy of automated actions

What’s Hype (or Premature)?

While some applications are working today, others are still aspirational or speculative:

❌ Fully Autonomous SOCs

Vendor claims of SOC teams run entirely by AI that needs minimal human oversight are overblown at present. AI excels at assistance, not autonomous defense decision‑making without human‑in‑the‑loop review.

❌ Predictive AI That “Anticipates All Attacks”

There are promising approaches in predictive analytics, but true prediction of unknown attacks with high fidelity is still research‑oriented. Real‑world deployments rarely provide reliable predictive control without heavy contextual tuning.

❌ AI Agents With Full Control Over Remediations

Agentic AI — systems that take initiative across environments — are an exciting frontier, but their use in live environments remains early and risk‑laden. Expectations about autonomous agents running response workflows without strict guardrails are unrealistic (and risky).

A Practical AI Use Case Taxonomy

A clear taxonomy helps differentiate today’s practical uses from tomorrow’s hype. Here’s a simple breakdown:

Category	What Works Today	Implementation Maturity
Detection	Anomaly/Pattern detection in logs & network	Mature
Triage & Enrichment	Alert prioritization & context enrichment	Mature
Automation Assistance	Scripted, human‑supervised response tasks	Growing
Predictive Intelligence	Early insights, threat trend forecasting	Emerging
Autonomous Defense Agents	Research & controlled pilot only	Experimental

Deployment Playbooks for 3 Practical Use Cases

1️⃣ AI‑Enhanced Log Triage

Objective: Reduce analyst time spent chasing false positives.
Steps:
1. Integrate machine learning models into SIEM/XDR.
2. Tune models on historical data.
3. Establish feedback loops so analysts refine model behaviors.
Key metric: ROC curve for alert accuracy over time.

2️⃣ Phishing Detection & Response

Objective: Catch sophisticated phishing that signature engines miss.
Steps:
1. Deploy NLP‑based scanning on inbound email streams.
2. Integrate with threat intelligence and URL reputation sources.
3. Automate quarantine actions with human review.
Key metric: Reduction in phishing click‑throughs or simulated phishing failure rates.

3️⃣ SOAR‑Augmented Incident Response

Objective: Speed incident handling with reliable automation segments.
Steps:
1. Define response playbooks for containment and enrichment.
2. Integrate AI for contextual enrichment and prioritization.
3. Ensure manual checkpoints before broad remediation actions.
Key metric: MTTR before/after SOAR‑AI implementation.

Success Metrics That Actually Matter

To beat the hype, track metrics that tie back to business outcomes, not vendor marketing claims:

MTTD (Mean Time to Detect)
MTTR (Mean Time to Respond)
False Positive/Negative Rates
Analyst Productivity Gains
Time Saved in Triage & Enrichment

Lessons from AI Deployment Failures

Across the industry, failed AI deployments often stem from:

Poor data quality: Garbage in, garbage out. AI needs clean, normalized, enriched data.
Lack of guardrails: Deploying AI without human checkpoints breeds costly mistakes.
Ambiguous success criteria: Projects without business‑aligned ROI metrics rarely survive.

Conclusion: AI Is an Accelerator, Not a Replacement

AI isn’t a threat to jobs — it’s a force multiplier when responsibly integrated. Teams that succeed treat AI as a partner in routine tasks, not an oracle or autonomous commander. With well‑scoped deployment paths, clear success metrics, and human‑in‑the‑loop guardrails, AI can deliver real, measurable benefits today — even as the field continues to evolve.

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Critical Zero Trust Implementation Blunders Companies Must Avoid Now

Posted on October 20, 2025 by Brent Huston

Introduction: The Urgent Mandate of Zero Trust

In an era of dissolved perimeters and sophisticated threats, the traditional “trust but verify” security model is obsolete. The rise of distributed workforces and complex cloud environments has rendered castle-and-moat defenses ineffective, making a new mandate clear: Zero Trust. This security framework operates on a simple yet powerful principle: never trust, always verify. It assumes that threats can originate from anywhere, both inside and outside the network, and demands that no user or device be granted access until their identity and context are rigorously validated.

The Shifting Security Perimeter: Why Zero Trust is Non-Negotiable

The modern enterprise no longer has a single, defensible perimeter. Data and applications are scattered across on-premises data centers, multiple cloud platforms, and countless endpoints. This new reality is a goldmine for attackers, who exploit implicit trust within networks to move laterally and escalate privileges. This is compounded by the challenges of remote work; research from Chanty shows that 76% of cybersecurity professionals believe their organization is more vulnerable to cyberattacks because of it. A Zero Trust security model directly confronts this reality by treating every access request as a potential threat, enforcing strict identity verification and least-privilege access for every user and device, regardless of location.

The High Stakes of Implementation: Why Avoiding Blunders is Critical

Adopting a Zero Trust framework is not a minor adjustment—it is a fundamental transformation of an organization’s security posture. While the benefits are immense, the path to implementation is fraught with potential pitfalls. A misstep can do more than just delay progress; it can create new security gaps, disrupt business operations, and waste significant investment. Getting it right requires a strategic, holistic approach. Understanding the most common and critical implementation blunders is the first step toward building a resilient and effective Zero Trust architecture that truly protects an organization’s most valuable assets.

Blunder 1: Mistaking Zero Trust for a Product, Not a Strategy

One of the most pervasive and damaging misconceptions is viewing Zero Trust as a single technology or a suite of products that can be purchased and deployed. This fundamentally misunderstands its nature and sets the stage for inevitable failure.

The Product Pitfall: Believing a Single Solution Solves All

Many vendors market their solutions as “Zero Trust in a box,” leading organizations to believe that buying a specific firewall, identity management tool, or endpoint agent will achieve a Zero Trust posture. This product-centric view ignores the interconnectedness of users, devices, applications, and data. No single vendor or tool can address the full spectrum of a Zero Trust architecture. This approach often results in a collection of siloed security tools that fail to communicate, leaving critical gaps in visibility and enforcement.

The Strategic Imperative: Developing a Comprehensive Zero Trust Vision

True Zero Trust is a strategic framework and a security philosophy that must be woven into the fabric of the organization. It requires a comprehensive vision that aligns security policies with business objectives. This Zero Trust strategy must define how the organization will manage identity, secure devices, control access to applications and networks, and protect data. It is an ongoing process of continuous verification and refinement, not a one-time project with a clear finish line.

Avoiding the Trap: Actionable Steps for a Strategic Foundation

To avoid this blunder, organizations must begin with strategy, not technology. Form a cross-functional team including IT, security, networking, and business leaders to develop a phased roadmap. This plan should start by defining the most critical assets and data to protect—the “protect surface.” From there, map transaction flows, architect a Zero Trust environment, and create dynamic security policies. This strategic foundation ensures that technology purchases serve the overarching goals, rather than dictating them.

Blunder 2: Skipping Comprehensive Inventory and Underestimating Scope

A core principle of Zero Trust is that you cannot protect what you do not know exists. Many implementation efforts falter because they are built on an incomplete or inaccurate understanding of the IT environment. Diving into policy creation without a complete asset inventory is like trying to secure a building without knowing how many doors and windows it has.

The “Unknown Unknowns”: Securing What You Don’t See

Organizations often have significant blind spots in their IT landscape. Shadow IT, forgotten legacy systems, unmanaged devices, and transient cloud workloads create a vast and often invisible attack surface. Without a comprehensive inventory of all assets—including users, devices, applications, networks, and data—it’s impossible to apply consistent security policies. Attackers thrive on these “unknown unknowns,” using them as entry points to bypass security controls.

The Scope Illusion: Underestimating All Connected Workloads and Cloud Environments

The scope of a modern enterprise network extends far beyond the traditional office. It encompasses multi-cloud environments, SaaS applications, IoT devices, and API-driven workloads. Underestimating this complexity is a common mistake. A Zero Trust strategy must account for every interconnected component. Failing to discover and map dependencies between these workloads can lead to policies that either break critical business processes or leave significant security vulnerabilities open for exploitation.

Avoiding the Trap: The Foundational Importance of Discovery and Continuous Asset Management

The solution is to make comprehensive discovery and inventory the non-negotiable first step. Implement automated tools that can continuously scan the environment to identify and classify every asset. This is not a one-time task; it must be an ongoing process of asset management. This complete and dynamic inventory serves as the foundational data source for building effective network segmentation, crafting granular access control policies, and ensuring the Zero Trust architecture covers the entire digital estate.

Blunder 3: Neglecting Network Segmentation and Micro-segmentation

For decades, many organizations have operated on flat, highly permissive internal networks. Once an attacker breaches the perimeter, they can often move laterally with ease. Zero Trust dismantles this outdated model by assuming a breach is inevitable and focusing on containing its impact through rigorous network segmentation.

The Flat Network Fallacy: A Breadth-First Attack Vector

A flat network is an attacker’s playground. After gaining an initial foothold—often through a single compromised device or set of credentials—they can scan the network, discover valuable assets, and escalate privileges without encountering significant barriers. This architectural flaw is responsible for turning minor security incidents into catastrophic data breaches. Relying on perimeter defense alone is a failed strategy in the modern threat landscape.

The Power of Micro-segmentation: Isolating Critical Assets

Micro-segmentation is a core tenet of Zero Trust architecture. It involves dividing the network into small, isolated zones—sometimes down to the individual workload level—and enforcing strict access control policies between them. If one workload is compromised, the breach is contained within its micro-segment, preventing the threat from spreading across the network. This granular control dramatically shrinks the attack surface and limits the blast radius of any security incident.

Avoiding the Trap: Designing Granular Access Controls

To implement micro-segmentation effectively, organizations must move beyond legacy VLANs and firewall rules. Utilize modern software-defined networking and identity-based segmentation tools to create dynamic security policies. These policies should enforce the principle of least privilege, ensuring that applications, workloads, and devices can only communicate with the specific resources they absolutely require to function. This approach creates a resilient network where lateral movement is difficult, if not impossible.

Blunder 4: Overlooking Identity and Access Management Essentials

In a Zero Trust framework, identity is the new perimeter. Since trust is no longer granted based on network location, the ability to robustly authenticate and authorize every user and device becomes the cornerstone of security. Failing to fortify identity management practices is a fatal flaw in any Zero Trust initiative.

The Weakest Link: Compromised Credentials and Privileged Accounts

Stolen credentials remain a primary vector for major data breaches. Weak passwords, shared accounts, and poorly managed privileged access create easy pathways for attackers. An effective identity management program is essential for mitigating these risks. Without strong authentication mechanisms and strict controls over privileged accounts, an organization’s Zero Trust ambitions will be built on a foundation of sand.

The Static Access Mistake: Assuming Trust After Initial Authentication

A common mistake is treating authentication as a one-time event at the point of login. This “authenticate once, trust forever” model is antithetical to Zero Trust. A user’s context can change rapidly: they might switch to an unsecure network, their device could become compromised, or their behavior might suddenly deviate from the norm. Static trust models fail to account for this dynamic risk, leaving a window of opportunity for attackers who have hijacked an active session.

Avoiding the Trap: Fortifying Identity Security Solutions

A robust Zero Trust strategy requires a mature identity and access management (IAM) program. This includes enforcing strong, phishing-resistant multi-factor authentication (MFA) for all users, implementing a least-privilege access model, and using privileged access management (PAM) solutions to secure administrative accounts. Furthermore, organizations must move toward continuous, risk-based authentication, where access is constantly re-evaluated based on real-time signals like device posture, location, and user behavior.

Blunder 5: Ignoring Third-Party Access and Supply Chain Risks

An organization’s security posture is only as strong as its weakest link, which often lies outside its direct control. Vendors, partners, and contractors are an integral part of modern business operations, but they also represent a significant and often overlooked attack vector.

The Extended Attack Surface: Vendor and Supply Chain Vulnerabilities

Every third-party vendor with access to your network or data extends your attack surface. These external entities may not adhere to the same security standards, making them prime targets for attackers seeking a backdoor into your organization. In fact, a staggering 77% of all security breaches originated with a vendor or other third party, according to a Whistic report. Ignoring this risk is a critical oversight.

Lax Access Control for External Entities: A Gateway for Attackers

Granting vendors broad, persistent access—often through traditional VPNs—is a recipe for disaster. This approach provides them with the same level of implicit trust as an internal employee, allowing them to potentially access sensitive systems and data far beyond the scope of their legitimate needs. If a vendor’s network is compromised, that access becomes a direct conduit for an attacker into your environment.

Avoiding the Trap: Strict Vetting and Granular Controls

Applying Zero Trust principles to third-party access is non-negotiable. Begin by conducting rigorous security assessments of all vendors before granting them access. Replace broad VPN access with granular, application-specific access controls that enforce the principle of least privilege. Each external user’s identity should be strictly verified, and their access should be limited to only the specific resources required for their role, for the minimum time necessary.

Blunder 6: Disregarding User Experience and Neglecting Security Awareness

A Zero Trust implementation can be technically perfect but fail completely if it ignores the human element. Security measures that are overly complex or disruptive to workflows will inevitably be circumvented by users focused on productivity.

The Friction Fallout: User Workarounds and Shadow IT Resurgence

If security policies introduce excessive friction—such as constant, unnecessary authentication prompts or blocked access to legitimate tools—employees will find ways around them. This can lead to a resurgence of Shadow IT, where users adopt unsanctioned applications and services to get their work done, creating massive security blind spots. A successful Zero Trust strategy must balance security with usability.

The Human Firewall Failure: Lack of Security Awareness Training

Zero Trust is a technical framework, but it relies on users to be vigilant partners in security. Without proper training, employees may not understand their role in the new model. They may fall for sophisticated phishing attacks, which have seen a 1,265% increase driven by GenAI, unknowingly providing attackers with the initial credentials needed to challenge the Zero Trust defenses.

Avoiding the Trap: Empowering Users with Secure Simplicity

Strive to make the secure path the easy path. Implement solutions that leverage risk-based, adaptive authentication to minimize friction for low-risk activities while stepping up verification for sensitive actions. Invest in continuous security awareness training that educates employees on new threats and their responsibilities within the Zero Trust framework. When users understand the “why” behind the security policies and find them easy to follow, they become a powerful asset rather than a liability.

Blunder 7: Treating Zero Trust as a “Set It and Forget It” Initiative

The final critical blunder is viewing Zero Trust as a project with a defined endpoint. The threat landscape, technology stacks, and business needs are in a constant state of flux. A Zero Trust architecture that is not designed to adapt will quickly become obsolete and ineffective.

The Static Security Stagnation: Failing to Adapt to Threat Landscape Changes

Attackers are constantly evolving their tactics. A security policy that is effective today may be easily bypassed tomorrow. A static Zero Trust implementation fails to account for this dynamic reality. Without continuous monitoring, analysis, and refinement, security policies can become stale, and new vulnerabilities in applications or workloads can go unnoticed, creating fresh gaps for exploitation. Furthermore, the integration of automation is crucial, as organizations using security AI can identify and contain a data breach 80 days faster than those without.

Conclusion

Successfully implementing a Zero Trust architecture is a transformative journey that demands strategic foresight and meticulous execution. The path is challenging, but by avoiding these critical blunders, organizations can build a resilient, adaptive security posture fit for the modern digital era.

The key takeaways are clear:

Embrace the Strategy: Treat Zero Trust as a guiding philosophy, not a checklist of products. Build a comprehensive roadmap before investing in technology.
Know Your Terrain: Make complete and continuous inventory of all assets—users, devices, workloads, and data—the absolute foundation of your initiative.
Isolate and Contain: Leverage micro-segmentation to shrink your attack surface and prevent the lateral movement of threats.
Fortify Identity: Make strong, adaptive identity and access management the core of your security controls.
Balance Security and Usability: Design a framework that empowers users and integrates seamlessly into their workflows, supported by ongoing security awareness.
Commit to the Journey: Recognize that Zero Trust is an iterative, ongoing process of refinement and adaptation, not a one-time project.

By proactively addressing these potential pitfalls, your organization can move beyond legacy security models and chart a confident course toward a future where trust is never assumed and every single access request is rigorously verified.

Contact MicroSolved, Inc. for More Information or Assistance

For expert guidance on implementing a resilient Zero Trust architecture tailored to your organization’s unique needs, consider reaching out to the experienced team at MicroSolved, Inc. With decades of experience in information security and a proven track record of helping companies navigate complex security landscapes, MicroSolved, Inc. offers valuable insights and solutions to enhance your security posture.

Phone: Reach us at +1.614.351.1237
Email: Drop us a line at info@microsolved.com
Website: Visit our website at www.microsolved.com for more information on our services and expertise.

Our team of seasoned experts is ready to assist you at any stage of your Zero Trust journey, from initial strategy development to continuous monitoring and refinement. Don’t hesitate to contact us for comprehensive security solutions that align with your business goals and operational requirements.

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

5 Fun-tastic Fall Activities for Information Security Teams

Posted on September 23, 2023 by Brent Huston

Fall is in the air, and along with pumpkin spice lattes and cozy sweaters, it’s also the perfect time for information security teams to step out of their digital shells and engage with other departments in their organizations. While security is serious business, there’s no harm in adding a dash of fun to foster better collaboration and understanding. Here are five light-hearted yet factual activities to spice up your information security team’s fall:

1. Cybersecurity Pumpkin Carving Contest

Unleash your inner artist and host a cybersecurity-themed pumpkin carving contest. Encourage teams from all departments to carve out their favorite security tools, icons, or even infamous cyber villains. Not only does this activity tap into everyone’s creative side, but it also sparks conversations about the importance of protecting the digital realm while having a gourd time!

2. “Escape the Phishing” Maze

Turn the concept of an escape room into an interactive cybersecurity challenge. Create a “phishing” maze where participants need to navigate through a series of puzzles and scenarios related to online security. This activity not only educates participants about the dangers of phishing attacks but also gets them working together to solve problems, fostering team spirit.

3. Crypto Treasure Hunt

Transform your office space into a treasure hunting ground by organizing a crypto-themed treasure hunt. Provide clues related to encryption, decryption, and security best practices that lead teams from one clue to another. Not only does this activity promote learning about cryptography, but it also encourages friendly competition among departments.

4. Security Awareness Fair

Set up a “Security Awareness Fair” in your office’s common area. Each department can have its own booth showcasing their approach to security. From IT’s “Spot the Vulnerability” game to HR’s “Password Strength Analyzer,” everyone gets to display their security prowess in a fun and informative way. This fair promotes cross-departmental engagement and ensures that everyone learns a thing or two about cybersecurity.

5. Cyber Movie Night

Host a cybersecurity-themed movie night with popcorn and cozy blankets. Screen movies like “Hackers,” “WarGames,” or even cybersecurity documentaries. After the movie, encourage lively discussions about what’s accurate and what’s exaggerated in the portrayal of hacking and security. It’s a laid-back way to bridge the gap between tech-savvy and non-technical teams.

Remember, the goal of these activities isn’t just to have fun, but to build bridges between information security teams and other departments. By approaching cybersecurity engagement with a light-hearted touch, you’re more likely to break down barriers, share knowledge, and create a culture of collaboration that lasts beyond the fall season. So, gear up for a season of learning, laughter, and interdepartmental camaraderie!

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

New Book Launch: We Need To Talk: 52 Weeks To Better Cyber-Security

Posted on February 7, 2023 by Brent Huston

I have released a new e-book titled “We Need To Talk: 52 Weeks To Better Cyber-Security.” I self-published through PublishDrive and MSI. It has been quite an interesting project, and I learned a lot in both writing/editing (with an AI), and in the publishing aspects.

The book provides a comprehensive approach to discussing cyber-security, addressing topics such as risk management, configuration management, vulnerability management, policy, threat intelligence, and incident response. The discussions that are sparked will lead to helping your team strengthen and mature your organization’s security posture.

The book is designed for information security professionals and their teams looking for a structured way to improve their organization’s cyber-security posture over one year. It is an ideal resource for those teams who wish to develop a well-rounded understanding of cyber-security and gain insight into the various elements that are needed for a successful program.

The book is 111 pages and sells for $9.99 in most of the ebook stores below:

Amazon

Apple

Barnes & Noble

Check it out, and please leave a review if you don’t mind taking the time. It will be much appreciated.

Print-on-demand options and other stores will be coming shortly. Hopefully, the book helps folks build better infosec programs. As always, thanks for reading, and stay safe out there!

Supply Chain Security Insights

Posted on September 2, 2022 by Brent Huston

Supply chain attacks are one of the most common cyber threats faced by organizations. They are costly and disruptive, often resulting in lost revenue and customer trust.

In this article, we’ll discuss five insights about supply chain attacks that all supply chain management and information security teams should be aware of.

#1. Supply Chains Can Be Vulnerable

Supply chains are complex networks of companies, suppliers, customers, and partners that provide goods and services to each other.

They include manufacturers, distributors, retailers, service providers, logistics providers, and others.

These entities may interact directly or indirectly via intermediaries such as banks, insurance companies, payment processors, freight forwarders, customs brokers, etc.

Supply chains are vulnerable to attack because they involve multiple parties and interactions between them. Each organization in the chain will have its own risk profile, security posture, and business model. This creates a complex environment for security risks. Attackers can target any part of the supply chain, and often focus on the weakest link, including manufacturing facilities, distribution centers, warehouses, transportation hubs, retail stores, etc.

Attackers can disrupt operations, steal intellectual property, damage reputation, and cause losses in revenue and profits.

#2. Supply Chain Security Must Include All Stakeholders

Supply chain security involves protecting against threats across the entire value stream. This means securing data, processes, systems, physical assets, personnel, and technology.

It also requires integrating security practices and technologies across the entire organization.

This includes ensuring that information sharing occurs among stakeholders, that employees understand their roles and responsibilities, and that policies and procedures are followed.

Security professionals should collaborate closely with executives, managers, and staff members to ensure that everyone understands the importance of security and has ownership over its implementation.

#3. Supply Chain Security Requires Ongoing Monitoring and Maintenance

Supply chain security requires ongoing monitoring and maintenance.

An effective approach is to continuously monitor the status of key indicators, assess risks, identify vulnerabilities, and implement countermeasures.

For example, an attacker could attempt to compromise sensitive data stored in databases, websites, mobile apps, and other locations.

To prevent these incidents, security teams should regularly review logs, audit reports, and other intelligence sources to detect suspicious activity.

They should also perform penetration tests, vulnerability scans, and other assessments to uncover potential weaknesses.

#4. Supply Chain Security Requires Collaboration Across Organizations

A single department cannot manage supply chain security within an organization.

Instead, it requires collaboration across departments and functional areas, including IT, finance, procurement, human resources, legal, marketing, sales, and others.

Each stakeholder must be responsible for maintaining security, understanding what constitutes acceptable behavior, and implementing appropriate controls.

Collaborating across organizational boundaries helps avoid silos of knowledge and expertise that can lead to gaps in security awareness and training.

#5. Supply Chain Security Is Critical to Organizational Success

Organizations that fail to protect their supply chains face significant financial penalties.

A recent study found that supply chain breaches cost United States businesses $6 trillion annually.

That’s equivalent to nearly 10% of the annual global GDP.

Supply chain attacks can result in lost revenues, damaged reputations, and increased costs.

Companies that invest in supply chain security can significantly improve operational efficiency, productivity, profitability, and brand image.

How to Rotate Your SSH Keys

Posted on April 19, 2022 by Brent Huston

SSH keys are used to secure access to and authenticate authorized users to remote servers. They are stored locally on the client machine and are encrypted using public-key cryptography. These keys are used to encrypt communications between the client and server and provide secure remote access.

When you log into a remote machine, you must provide a valid private key to decrypt the traffic. As long as the private key remains secret, only you can access the server. However, if someone obtains your private key, they can impersonate you on the network.

SSH key rotation helps prevent this type of unauthorized access. It reduces the risk that someone has access to your private key, and helps prevent malicious users from being able to impersonate you on your network.

Most security policies and best practices call for rotating your key files on a periodic basis, ranging from yearly to quarterly, depending on the sensitivity of the data on the system. Such policies go a long way to ensuring the security of authentication credentials and the authentication process for sensitive machines.

There are two ways to rotate your keys: manually, and automatically.

Manually

To manually perform key rotation, you need to generate a new pair of keys. Each time you do this, you create a new key pair. You then upload the public key file to the server you wish to connect to. Once uploaded, the server uses the public key to verify that you are who you say you are.

Automatically

An alternative approach is to use automatic key rotation. With automatic rotation, you don’t need to generate a new key pair each time you change your password. Instead, you simply update the permissions on your existing key file.

The following steps show how to configure automatic rotation.

1. Generate a new keypair

2. Upload the public key to the remote server

3. Configure the remote server to use the new keypair

4. Update the permissions on the old keypair file

5. Delete the old keypair

6. Logout from the remote server

More Information

On Linux systems, use the “man” command to learn more about the following:

- ssh-keygen command
- ssh-public-key command
- upload-ssh-public-key command

The examples should provide options for command parameters and sample command output for your operating system.

For more information about the SSH protocol, you can review the Wikipedia article here.

Four Uses for the Raspberry Pi in Small Business Security

Posted on April 18, 2022 by Brent Huston

With Raspberry Pi systems now available fully decked out for under $100, there are many uses that small business security teams can find for these versatile devices. Here are four of our favorites for using them in security roles.

1. Honeypot for Detecting Attackers on Your Network

Our HoneyPoint™ Agent runs on the Pi. It allows you to monitor for potential network compromises and attempts to breach your network by offering a fake system for attackers to target. Since the system has no real use, any interaction with it is suspicious at best, and malicious at worst. This allows for an easy-to-manage detection tool for your business.

2. Nessus Scanning Engine for Vulnerability Management

Nessus now supports running on the Pi 4 with 8 Gigs of RAM. Nessus is a very popular and powerful vulnerability scanner. With it, you can scan your network for vulnerabilities and find out what software needs updating.

3. Run Pi-Hole for Content Filtering

Pi-Hole is one of the best open-source security tools on the Internet. It provides enterprise-quality content filtering for free. Drop this on your network and implement it following the online instructions, and you’ve got affordable protection against malicious advertising, bad content, and many types of malware that inject via the browser.

4. Build a Cheap VPN Server

PiVPN makes setting a VPN for your small business needs incredibly simple. You can use this feature to access systems while you’re away or just to stay safer on public wireless networks. Most folks can deploy this in under an hour, and it can save you an immense amount of risk.

Using a Pi for some other risk management or security purpose? We’d love to hear about it. Drop me a line on Twitter (@lbhuston) and let me know what you’re up to. We’ll feature any ground breaking ideas in future posts.