Enterprise Security WeeklySubscribe
AI benefits/risks, Acquisition, Career Management, Governance, Risk and Compliance, Security Strategy, Plan, Budget, Risk Identification/Classification/Mitigation, Cloud Security, Data Security, AI/ML

Cybersecurity Budgets: the Journey from Reactive to Proactive – Todd Thiemann, Theresa Lanowitz – ESW #383

Full Audio

View Show Index

Segments

1. Cybersecurity Budgets: the Journey from Reactive to Proactive – Theresa Lanowitz – ESW #383

CISOs struggle more with reactive budgets than CIOs or CTOs. It's not that part of the CISO's budget shouldn't be reactive, it's certainly necessary to an extent. The problem is when proactive measures suffer as a result. In this interview, we'll discuss some of the causes behind this and some strategies for breaking out of this loop.

This segment is sponsored by LevelBlue. Visit https://securityweekly.com/levelblue to learn more about them!

Sponsored By

LevelBlue

Guest

Chief Evangelist at LevelBlue

Theresa Lanowitz is the Chief Cybersecurity Evangelist at LevelBlue, a strategic alliance between AT&T and WillJam Ventures, that simplifies cybersecurity for the businesses fueling our global economy.

With a distinguished career in the technology industry, she has held influential roles at companies including Gartner, Borland, Taligent, and Sun Microsystems, significantly impacting application security and emerging technologies.

Theresa is a globally respected leader known for her deep and diverse experience in cybersecurity. Theresa frequently speaks at major industry conferences, sharing her insights on high tech trends, AI integration, and the evolving threat landscape.

Theresa holds a Bachelor of Science in Computer Science from the University of Pittsburgh, Pittsburgh, PA.

Hosts

Principal Researcher at The Defenders Initiative
Product Marketer and Content Strategist at OX Security

2. The State of DSPM, One of the Hottest New Cybersecurity Markets in Years – Todd Thiemann – ESW #383

Is it a product or a feature? Is it DLP 4.0, or something legitimately new? Buy now, or wait for further consolidation?

There are SO many questions about this market. It's undeniably important - data hygiene and governance continues to be a frustrating mess in many organizations, but is this the solution? We'll discuss with Todd to find out.

Guest

Senior Analyst at Enterprise Strategy Group

Todd is a Senior Analyst at the Enterprise Strategy Group looking at data security and identity & access management.

He has been around the block in cybersecurity with over a decade of industry experience across a range of subjects including encryption, key management, IAM/authentication, identity security, and security operations at leading cybersecurity companies including Arctic Wolf Networks, ReliaQuest, Trend Micro, Vormetric/Thales, and Nok Nok Labs.

He was born and raised in Palo Alto, California and still lives there. For the football fans out there, one of Todd’s claims to fame is that he was the center on the Palo Alto High School football team when a guy named Jim Harbaugh was quarterback.

Hosts

Principal Researcher at The Defenders Initiative
Product Marketer and Content Strategist at OX Security

3. $200M for IoT security, 4 acquisitions, fake job openings, vapes are trash – ESW #383

In the enterprise security news,

  1. Some big fundings
  2. no less than 4 acquisitions
  3. Silencing the EDR silencers
  4. ghost jobs
  5. overinflated estimates on open cybersecurity jobs
  6. weaponizing Microsoft Copilot
  7. fun projects with disposable vapes

All that and more, on this episode of Enterprise Security Weekly.

Hosts

Principal Researcher at The Defenders Initiative
  1. 1. FUNDING: Security, Funded #168 – Armis, Bugcrowd, Zenity, Island, Tidal, and Secret Double Octopus

    Some select funding announcements from the latest Security, Funded newsletter:

    1. Armis raises $200M, boosting valuation to $4.3B in push towards IPO
    2. Bugcrowd Secures $50 Million Growth Capital Facility from Silicon Valley Bank - and announced Trey Ford as their new CISO!
    3. Zenity Raises $38M Series B Funding Round to Secure Agentic AI

    A few other interesting fundings without numbers attached:

  2. 2. ACQUISITIONS: CompTIA, Normalyze, Detectify

    Some very notable acquisitions this week!

    1. H.I.G. Capital and Thoma Bravo to Acquire CompTIA Brand and Products
    2. Normalyze gets picked up by Proofpoint in what marks the eighth DSPM acquisition in 2 years, according to Mike Privette. I haven't seen a category get snatched up this quick since the CASB market got vacuumed up in 2016/2017.
    3. Detectify Receives Majority Investment from Insight Partners
    4. Last, but not least, CrowdStrike gets into SaaS security with the acquisition of Adaptive Shield - I'm curious to see if this triggers a buy-off of SSPM vendors, starting with AppOmni, which is already partnered with Wiz.
  3. 3. ANALYSIS: Silencing the EDR Silencers

    We discussed EDR Silencers on episode 380 of this podcast, and this is one of the more interesting responses we've seen to this malware trick.

    TL;DR, EDR silencers simply create firewall rules that prevent popular EDR software from sending data to their consoles, effectively silencing them.

  4. 4. JOBS: A lot of demoralized people’: Ghost jobs are wreaking havoc on tech workers

    I didn't realize this was going on, but it is yet another insight into why we keep hearing cybersecurity is so flush with jobs from some sources (looking at you, ISC2 and Cybersecurity Ventures), while hearing that it takes 6+ months on average to land cybersecurity jobs from people actually vying for open positions.

  5. 5. JOBS: An Open Letter to the ISC2 Board

    I often find myself disagreeing with Ira Winkler, but in this case we're in violent agreement. Something stinks about the job numbers that organizations like ISC2 have been promoting and Ira spotted something I missed when analyzing this myth for my talks on "Myths and Lies in InfoSec".

    What I missed was some fine print that stated:

    The ISC2 Cybersecurity Workforce Gap is an estimate of the number of people needed globally to adequately secure organizations. The workforce gap is not an estimate of open positions or cybersecurity jobs available.

    First off, NO ONE KNOWS how many people are needed to secure organizations. We don't even have a good way to measure the efficacy of the employees we already have! It's also entirely possible that a bad employee, or an employee doing the wrong thing can make an organization less secure.

    Combine this with the recent fact I learned, that it is commonplace for companies to post 'ghost jobs', and I don't think we can trust ANY of the stats we see about open jobs in the industry.

  6. 6. ATTACKS: How to Weaponize Microsoft Copilot for Cyberattackers

    I missed this back during hacker summer camp, but was SHOCKED at how quickly and easily Microsoft 365 Copilot can be poisoned.

  7. 7. DATA: Welcome to the Artificial Intelligence Incident Database
  8. 8. DATA: MITRE Launches AI Incident Sharing Initiative
  9. 9. TOOLS: GenAI Usage Policy Generator
  10. 10. SQUIRREL: Powering an E-Bike using Disposable Vape Batteries
Product Marketer and Content Strategist at OX Security