Jason Cradit, MBA, CISSP

What if I told you the most dangerous breaches don’t start with code? I just watched Adolescence, a four episode drama about a 13 year old boy accused of a serious crime. It’s emotional. Powerful. But what really hit me? The reminder that vulnerabilities start long before a breach happens. It begins with neglect. Behavior that goes unseen. Silence that builds up over time. The series digs into online bullying, the psychological damage, and how toxic personas are shaped and amplified by social media. Sounds familiar? In cybersecurity, we talk about firewalls, zero-days, encryption. But the real breach starts with people. With manipulation. Social engineering. Emotional pressure. Especially on teenagers trying to survive a hyperconnected world. Adolescence isn’t just a show. It’s a case study. A story of trust lost, influence unchecked, and digital damage that starts way before the system is compromised. If you work in #CyberSecurity, #DigitalEthics, #ChildProtection, or #InfosecPolicy this is a must-watch. Because before there’s a breach in the system… There’s a breach in trust.

15

8 Comments

One of the most outdated assumptions I still see in cybersecurity is the belief that "it won't happen to us." There's no such thing as zero risk. No matter how mature your controls are or how well-intentioned your team is, every organization has exposure. One of my go-to principles is simple: Bad things happen to good companies. That's not pessimism... It's reality. The difference is how you prepare, how you respond, and how quickly you recover. Risk doesn't disappear, but with the right mindset, you can make sure it doesn't define you. #Cybersecurity #RiskManagement #Leadership #CISO

26

4 Comments

When it comes to building a team, my focus is simple: hire the right person for the job. Skills, integrity, and fit with the team’s mission are what's important. Who they are isn't the deciding factor, but how they show up and deliver absolutely is. On my team, respect is non-negotiable. From day one, I make it clear that discrimination, sexist behavior, or "old boys’ club" nonsense has no place here. We're here to do cyber work, collaborate, and support one another. That approach has led to a team where 12 out of 50 members are women in cyber roles - not because of quotas, but because talented people thrive when the environment is fair, professional, and collaborative. When you set the tone for respect, the right talent sticks around and does their best work. #Leadership #Cybersecurity #TeamCulture #RespectAtWork

64

8 Comments

True Integrity Never Needs an Announcement The most trustworthy systems don’t broadcast that they’re secure. They operate securely. The same is true of people. In information security, credibility is not created by claims. It is proven by behavior under pressure. No secure system wastes bandwidth announcing its defenses. It quietly enforces controls, logs actions, and maintains consistency, day after day. Character works the same way. You will never see a person with deep integrity trying to convince others that they are “good.” They don’t posture. They don’t perform morality. They don’t seek validation. They operate authentically. High-emotional-intelligence professionals understand this: Reputation is not a marketing campaign. It is an audit trail. Integrity is revealed in: ▪︎ How decisions are made when no one is watching ▪︎ How power is exercised when it could be abused ▪︎ How people are treated when there is nothing to gain ▪︎ How consistency is maintained when shortcuts are tempting This is why the most respected leaders are often the least loud. Recruiters across the globe, aren’t searching for people who talk about ethics. They look for professionals whose patterns prove it. In security, we trust systems that are: ▪︎ Predictable under stress • Transparent in behavior ▪︎ Consistent over time ▪︎ Resilient to manipulation In people, those same qualities define character. Authenticity needs no defense mechanism. Integrity has nothing to prove. And the paradox is this: The quieter your character, the louder your credibility. Strong systems don’t explain themselves. They simply work. So do people with character. If your professional behavior were audited today, what would it reveal, consistency or performance? If you believe leadership, trust, and career growth are built on emotional intelligence, integrity, and security-grade discipline, follow for insights that help professionals build credibility that speaks for itself - globally. — Uba Obani #Integrity #EmotionalIntelligence #ProfessionalCredibility #LeadershipCharacter #InformationSecurity #CybersecurityMindset #TrustAndLeadership #GlobalProfessionals #CareerIntegrity #HighPerformanceProfessionals #EthicalLeadership #UbaObani

69

5 Comments

Last week I asked cyber leaders about their #1 AI challenge. Two responses cut through the noise: "We need AI that accelerates security, not AI that creates new blind spots." "Everyone wants AI automation, but no one wants to admit their IAM data quality is the biggest blocker." Both are right. And they're connected. Teams are stuck between two realities: 1. AI promises speed - faster access reviews, threat modeling, policy mapping 2. But most orgs don't have the data quality or governance to trust AI decisions So what happens now? Slow adoption. Pilots that stall. Leaders caught between pressure to "use AI" and fear of exposing gaps they've been managing around for years. AI won't save broken data. It'll expose it. AI won't create transparency. It'll demand it. The cyber leaders who navigate this won't be the ones who adopt AI fastest, but the ones who fix the foundation first AND build teams who can govern what they automate. Where's your team? Fixing the foundation? Piloting anyway? Stuck in between? No judgment zone. Thanks for the feedback Amit Subhanje (CISM, CISA, CRISC, CGEIT, CIPM) and Ross Rizaev

15

2 Comments

Spending time in Phoenix, AZ, at a recent Cyber and Compliance conference served as a strong reminder of the value of connecting with like minded professionals in this field. There is something powerful about being in a room with peers who are navigating similar challenges balancing risk, compliance, business priorities, and limited resources often within very different organizations, yet facing comparable realities. One theme consistently emerged during the discussions: the primary challenge remains securing sustained C-suite understanding and buy in for a mature, disciplined cybersecurity program. Cybersecurity has evolved beyond a technical issue; it is now a business risk issue. While frameworks, controls, and tools continue to advance, leadership alignment remains the critical factor in determining whether programs succeed or face difficulties. Events like this highlight that these challenges are not isolated. They are shared across industries, and progress is accelerated when professionals collaborate, exchange insights, and learn from one another. Appreciative of the conversations, perspectives, and ongoing learning. #CyberSecurity #Compliance #RiskManagement #CyberLeadership #CISO #SecurityCulture

33

Although labeled “low scale,” this social engineering breach is a glaring reminder: attackers don’t need deep system access to wreak havoc; they just need trust. Workday did well to contain it quickly, but it's a wake-up call to tighten both technological and human defenses across vendor ecosystems. https://bit.ly/3I3AQzP

6

1 Comment

Every time I hit a wall learning something new in tech, I do this: I ask myself: "What's the Oil & Gas version?" Example: Kafka brokers confused me at first. Leader broker, follower brokers, replication, failover... Then it hit me: This is just pump cascade configuration. Running pump handles the load. Standby pumps monitor and replicate. Automatic switchover if the primary fails. Same pattern. Different domain. Boom. Instant understanding. This has been my learning cheat code for the past year. When distributed systems get complicated, I translate them to offshore operations first. Suddenly everything clicks. In oil & gas, I managed physical infrastructure - pumps, compressors, control systems. In tech, it's virtual infrastructure - servers, containers, cloud services. The principles are the same: maintain uptime, respond to incidents, optimize performance, control costs. Your old domain expertise isn't baggage. It's a learning accelerator. If you're transitioning careers, stop trying to forget what you know. Use it as a bridge. What's your learning cheat code? #SRE #CareerTransition #DistributedSystems #OilAndGas #LearningMethod

9

⚠️ When AI Mistakes Snacks for Threats How an AI False Alarm Turned Doritos into a Security Scare In Baltimore, a 16-year-old student, Taki Allen, was handcuffed at gunpoint , all because an AI-powered gun detection system misidentified a crumpled Doritos bag as a firearm. The system, Omnilert, was installed to prevent shootings by monitoring school surveillance feeds for potential weapons. But this time, a false alarm led to panic, and an innocent teen being detained. Why This Control Was Implemented After several tragic school shootings, schools across the U.S. adopted AI-based surveillance and weapon detection systems like Omnilert. These tools analyze live CCTV footage to detect possible firearms and alert law enforcement, their mission simple: save minutes, save lives. But what happens when the system gets it wrong? The Issue: When AI Sees Threats That Aren’t There The algorithm flagged the metallic reflection of a Doritos bag as a potential gun. The outcome: A teenager experienced trauma and public humiliation Trust in AI surveillance took a major hit Parents and officials began calling for algorithm audits and transparency Why It Matters AI systems are only as honest as their data and as careful as their oversight. Without thorough validation and human review, false positives become real world dangers, turning “smart” safety into psychological harm. Let’s remember: AI can enhance security — but never without accountability, testing, and ethical design. #AISecurity #AIAwareness #SecurityBites #SaurabhJain #ArtificialIntelligence #CyberSafety #EthicalAI #AIinSchools

19

2 Comments

Networking isn't just about cables and racks—it’s the silent engine behind everything we do in Tech. I remember when I first started, I thought a "Switch" and a "Router" were basically the same thing. I quickly learned that if you don't understand the fundamentals of networking, you'll struggle in Cloud, DevOps, or Cybersecurity. I found this "Complete Guide" for Network Engineers and had to share it. It’s one of the cleanest "cheat sheets" I’ve seen for the basics. Why this is a must-save: 1.It breaks down the OSI Layers in simple terms (Switch vs. Router). 2. It lists the Port Numbers you’ll actually get asked about in interviews (80, 443, 53, 3389). 3. It explains DHCP & DNS—the two things that usually break when "the internet is down." Whether you are studying for your CCNA or you're a Developer who wants to understand how your app actually talks to the world, keep these basics in your back pocket. Quick Quiz for the experts: If you can't "ping" a server but the website loads fine in a browser, what's usually the first thing you check? Let’s see who knows their protocols! 👇 #Networking #NetworkEngineer #TechCommunity #CareerGrowth #CyberSecurity #CloudComputing #CCNA #ITInfrastructure #LearningAndDevelopment #DevOps #SystemAdministration #CareerAdvice

54

1 Comment

💻 Amazon WorkSpaces, Azure Virtual Desktop, and other cloud-based virtual desktops are great tools for temporary sandboxes or rarely used applications/environments. But please don't make people do all of their day-to-day work in there. Cloud-based virtual desktops delay every interaction because of the latency to the cloud. The virtual hardware tends to be slower than an average laptop too, so everything tends to run much slower. If you're in IT and considering moving applications to this kind of environment, please consider how it affects people who use them daily. I totally get that it's easier to provision applications like this, but there's a real cost on the other side if people can't do their jobs effectively. #oilandgas #tech #ux

22

13 Comments

Stop writing incident novels. Executives won’t read them. Leaders don’t want SIEM screenshots. They want a decision in 60 seconds. Here’s the 5-Sentence Incident Narrative I use: 1. What happened, in plain English 2. Business impact, quantified 3. Containment status right now 4. Top 1–2 risks if nothing changes 5. Decision needed today Real-world style: • “A contractor account accessed finance reports.” • “3k files at risk, no confirmed exfiltration.” • “Account disabled, tokens revoked, logs preserved.” • “Risk of lateral movement or fraud if reused.” • “Need approval to bring in third-party IR and notify Legal.” That’s it. Five sentences. Not five pages. And executives will actually read it. What’s the worst incident update you’ve ever seen — too vague, too long, or too technical?

18

Week 2 – Incident vs. Request: Why the Distinction Matters 🚨 Incident = Something is broken. 📩 Request = User needs something new. Why the difference matters: Incidents need speed + restore service. Requests need workflow + approvals. 📊 Real story: At one client, 40% of “incidents” were actually requests (like password resets). Once separated, SLA compliance shot up, and IT felt less “under fire.” 👉 How does your company handle this separation – clear or blurry lines?

6

1 Comment

Loosely speaking, Single Sign-On (SSO) is a core security requirement for any company with more than five employees. Yet many SaaS vendors only provide SSO at the Enterprise tier of their offering, which assumes a large user base and comes with a significantly higher price tag. This creates an unfortunate reality where security becomes a commercial lever — and a very expensive one. I recently came across a website that calls vendors out who use security capabilities, specifically SSO, to force customers into higher and more costly tiers. Check it out: https://sso.tax/ 👉 𝗪𝗵𝗮𝘁 𝗮𝗿𝗲 𝘆𝗼𝘂𝗿 𝘁𝗵𝗼𝘂𝗴𝗵𝘁𝘀? Should vendors include essential security features like SSO in their base plans, or do you believe these baseline capabilities should remain exclusive to enterprise tiers? 𝗖𝗹𝗮𝗿𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻: I fully support charging extra for advanced security features. My concern here is specifically about what I consider a fundamental capability — SSO.

32

8 Comments

Had the opportunity to attend the Millennium Alliance dinner on behalf of Veeam in Nashville last night, and let me tell you, it was an eye-opener. Great discussions around current ransomware trends hit different when you're sitting around a table with fellow IT leaders who've been in the trenches much longer than I. We dove deep into incident response strategies that actually work (not the theoretical stuff you read about) by way of "exercises", and more importantly, how to get our teams thinking cybersecurity-first without turning them into paranoid wrecks. What struck me most was separating the signal from the noise, understanding which attack scenarios are real threats today versus the ones that made headlines two years ago but aren't as relevant anymore. The cyber extortion landscape shifts faster than the weather forecast, and staying current on what actually works for resilience is crucial. As someone knee-deep in a digital transformation, these conversations around empowering teams with practical cybersecurity knowledge couldn't have come at a better time. It's not just about the tech stack, it's about building a culture where security becomes second nature. Thanks to the Millenium Alliance for hosting and to Veeam Software for the opportunity. Sometimes the best learning happens when you get smart people in a room who aren't afraid to share what's really working (and what isn't). #Cybersecurity #RansomwareProtection #DigitalTransformation #Veeam

6

1 Comment