Truth in IT

My good friends James McQuiggan and Mishaal Khan just released a tech industry dad joke book. It's awesome. A joke for every occasion and IT topic. If you want to laugh, cringe, and giggle, get this book. amazon.com/dp/B0H8NNPTW5

Is your company data on plastic tape? If you're handing over unencrypted crown jewels to a van driver, that's professional malfeasance. Encryption should be the default. #CyberSecurity #DataProtection

CBS reporter Matt Gutman was almost scammed into withdrawing his entire bank account and giving it to fraudsters claiming to be with his bank's fraud investigation team. Be aware! msn.com/en-us/money/ne…

AIAI Holdings Portco Alex Brandes @codebrandes, CTO of Constellation Network Video interview on @TruthinIT - Michael Matchett @smworldbigdata speaks with constellationgate.ai, about securing enterprise AI usage truthinit.com/index.php/vide…

Video interview on @TruthinIT - Michael Matchett @smworldbigdata speaks with Alex Brandes @codebrandes, CTO of Constellation Network constellationgate.ai, about securing enterprise #AI usage truthinit.com/index.php/vide…

Thanks to Mike Matchett (@smworldbigdata) for speaking with Jim Taylor about #passwordless, #governance, and #AI: "RSA is all in on AI. And all on defending against it." Watch how we're using it on @TruthinIT ⬇️ truthinit.com/index.php/vide…

I was quoted on a new Fortune magazine article on job scams. Good article. fortune.com/2026/06/27/job…

Literally the worst cable management I've ever seen in my life

This is crazy! Meta AI bot allowed anyone to add a new email account for a password reset to anyone else's account. What!!?? krebsonsecurity.com/2026/06/hacker…

SSH access is easy to set up on a one-off basis, but it gets harder to keep things tidy as more machines and users are added. Bastion hosts help to some extent, but long-lived keys tend to leak, manual user offboarding is painful, and compromised sessions are virtually impossible to revoke. One way to fix this is identity-aware SSH with short-lived certificates. Users authenticate with the company's IdP, obtain a session-wide SSH certificate, and continue using the plain "ssh" command for the rest of the process. This tutorial by Nick Taylor shows how to build such a solution with Pomerium - an open source identity-aware access proxy: labs.iximiuz.com/tutorials/nati… And the best part of it - you can actually follow all the steps right in your browser and get the setup work end-to-end.

Check out my latest article: AI Has Capabilities We Need linkedin.com/pulse/ai-has-c…

It's great that AI can quickly find a ton of vulnerabilities. Terrific! Want to truly impress me and have me believe in all the supposed super-intelligent AI hype you are selling? Have AI discover a new type of vulnerability that humans haven't already discovered.

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.

I'm excited to be speaking at RSAC again! I'll be doing 3 presentations, a book signing (4 of my books will be in the RSAC bookstore), and hanging out in the KnowBe4 most of the time. If you want to meet me, please come by.

A vendor just emailed us an invoice. Right logo. Right project. Right invoice number. New bank account. If we had paid it, $50K is gone. No recovery. No insurance. Just gone. We got an email a few days later that the vendors email had been hacked. This is happening to businesses every single day. And it's about to get much worse. AI is an incredible tool when it's used for good. But it is also a weapon. The same technology helping us underwrite deals and manage portfolios is helping criminals build perfect fraud at zero cost and infinite scale. The "Nigerian Prince" is dead. He's been replaced by AI that sits inside your vendor's email for months. It watches your payment cycles. It learns your controller's name. It waits for the perfect moment to swap banking info on a real invoice. It requires vigilance and good processes to not get fooled. Here are a few basic things we do: 1. Banking info changes = full stop. No exceptions. We stop and we call. 2. Never call the number on the new email. That's the hacker's number. We dig up the old contact info and call someone we already know. 3. Hold payment if there is a bank change. Every updated account gets a mandatory hold and a voice callback to the vendor. Two-minute phone call costs you nothing. One bad ACH is an expensive mistake. What else should we be doing?

@DallasAptGP @rogeragrimes You must also be careful of the 3rd party financial portals. They provide a false sense of security.

Unlock ultra-fast, resilient cloud infrastructure! Discover how StorPool with Oracle Virtualization power efficient HCI in our on-demand webinar. Watch now: hubs.ly/Q041JNPh0 #OracleVirtualization #SoftwareDefinedStorage #HCI #CloudInfrastructure #EnterpriseIT

Epic Systems filed a lawsuit accusing data brokers of masquerading as medical facilities in order to pull nearly 300,000 patient records. forbes.com/sites/monicahu… Almost certainly, this has been happening for decades at a far greater scale than this single instance.

Discover how Dustin Group boosted cloud performance, simplified ops, and scaled efficiently with StorPool’s software-defined storage. Read the full case study: hubs.ly/Q03W1_2d0 #StorPool #CloudInfrastructure #SDS #CaseStudy

Check out my latest article: Microsoft Help Desk Phishing Scam linkedin.com/pulse/microsof…