Signal vs. Noise - The Pulse

This week on the Signal vs. Noise cybersecurity podcast: the FBI and the Secret Service warned about FortiBleed, a campaign that has compromised more than 86,644 firewalls and VPN gateways by one security firm's count, using leaked and reused passwords.

Getting in didn't involve choosing anybody. What came next did: the attackers sorted what they'd caught by revenue and network structure, then sold the access.

Some companies can en...

This week on the Signal vs. Noise cybersecurity podcast: a small school district in Vermont found a ransom note on one of its servers.

More than three weeks later, its school board voted, in public, NOT to pay.

Security professionals, lawyers, the insurer and law enforcement all did the work. The board made the call.

At a 40-person company there's no board meeting. The board is you.

Why the worst week of your year is a bad time to ...

This week on the Signal vs. Noise cybersecurity podcast: an online whisky shop in the UK told its customers that their names, email addresses, phone numbers and shipping addresses had been taken.

The shop wasn't broken into, and neither was the platform it runs on.

The company behind one of its add-ons was, and that add-on held a key to the shop's customer information. The platform turned the key off.

The founder's name went on the...

This week on the Signal vs. Noise cybersecurity podcast: one person with a laptop and an AI chatbot broke into 395 organizations in 48 countries, most of them schools, through the same piece of printing software.

In twelve of them the attacker ended up holding the keys to the whole network. In the other 383, the attacker got the print server and the passwords on it, and stopped there.

The difference was not budget or headcount. It ...

This week on the Signal vs. Noise cybersecurity podcast: on September second the government published seven things that are being broken into right now, and you can read all seven without knowing whether one of them is yours.

That is not a competence problem. Attached to the list was something easy to miss, a rule for deciding which ones could wait, two questions long and written in plain English.

Why the translation already exists...

This week on the Signal vs. Noise cybersecurity podcast: a flaw that could have handed your identity system to a stranger left no trace inside your company, and that was the good outcome.

One layer down, a flaw in VMware vCenter went from disclosure to exploitation in five days, and the campaign that followed reached three hundred and sixty one addresses across forty seven countries.

Nobody looked any of them up by name.

Why "we're...

This week on the Signal vs. Noise cybersecurity podcast: eighty one million sign-in attempts in two weeks, seventy eight accounts taken over, and a lot of the companies behind them had multi-factor authentication switched on and enforced.

Nobody's phone buzzed.

Why the question every insurance form, vendor questionnaire and audit control asks about MFA is the wrong one, and what the right one costs to answer.

Five minutes, hosted b...

This week on the Signal vs. Noise cybersecurity podcast: the AI project that has sat on your leadership agenda for three quarters without ever being approved or killed.

There is always a meeting where a bet gets started and never one where a bet gets killed, so the no arrives late, as a rollback, after you have already paid for it.

One signal from the week's security news, traced through the cascade. Five minutes, hosted by Jane.

F...

Your AI agent's job description is one sentence long. Its access is not.

Last week the claim was that an AI agent is a dependency, and it fails outward.

So go look at the wires. Here is the catch: you cannot see an agent's blast radius by reading its job description.

When you hire a person, job and access drift into rough alignment, because access gets handed out slowly and human judgment is the limiter.

Deploying an agent inverts ...

Everyone is about to hand you an AI roadmap: where it goes, what to automate, which agent lands where.

That map is becoming a commodity, and it is the easy half. The half nobody is selling you is the one that decides the outcome: which of these AI bets can your business actually survive getting wrong?

An AI agent is not a tool you bolt on in its own box. It is a dependency wired into identity, data, workflow, and trust, and when it...

The finale of the six-week Measurement series, and a confession: this was never about vulnerabilities.

Vuln triage was the proving ground, the one corner of security where someone already hands you a real exploit probability, so the discipline is easy to see.

But the move underneath it (measure what is expensive, irreversible, and genuinely uncertain, and decide the rest without ceremony) is a leadership posture, not a patching tac...

Last Sunday I opened a paid pilot to help you measure security risk. So here is the whiplash: this week is about when measuring is the wrong move.

That is not me hedging. That is the whole point. A method you reach for every time is not a discipline. It is a tic. What turns measurement into discipline is knowing the decisions that do not earn it, and being willing to say so even when you sell the measuring.

Four times to close the sp...

For three weeks I showed you the method. Shrink forty-seven "criticals" to three. Reorder them by what's actually likely and actually expensive. Say the risk in one sentence a board can hear.

This week, the method stops being something you read and becomes something you can buy.

Three pilot slots. A fixed-scope engagement that takes one decision your team makes by severity alone, vulnerability triage, and rebuilds it on probability a...

A scanner hands a sixty-person firm 312 vulnerabilities, 47 of them flagged "critical," and a five-month queue to clear the reds.

This episode walks the backlog. No new tools, just the discipline at work.

Probability cuts 47 to 6. Asset value cuts 6 to 3.

Then the list reorders. A flaw the scanner rated "Medium" climbs into the final top 3, because the thing most likely to actually hurt the firm was buried in the middle of the pile.

Th...