Greg Patterson

90% of ISO 27001 projects look great on paper and change absolutely nothing. I’ve seen it hundreds of times. The certificate arrives. The team celebrates. Then… nothing. No faster sales. No stronger culture. No real control. Because most companies treat ISO 27001 as a compliance trophy not a commercial engine. Here’s what actually shifts the culture: ➤ When founders stop outsourcing responsibility and start owning the risk conversation. ➤ When engineers see controls as accelerators, not obstacles. ➤ When “security” becomes the language of delivery, not delay. ISO 27001 done right doesn’t just tick boxes, it changes how people think, decide, and sell. It makes your business audit-ready, deal-ready, and investor-proof every single day. That’s when the ROI kicks in. Fewer audit cycles. Faster procurement. More trust baked into every demo. Forget the paperwork. You’re not buying compliance. You’re buying credibility. The question is: does your certification live in your culture, or just on your wall? #ISO27001 #SaaSLeadership #CyberSecurityStrategy #StartupSecurity #B2BSales #FinTechSecurity #SecurityCulture #ComplianceThatWins #CISOLife #EnterpriseSales

11

1 Comment

The addition of the Govern function in NIST CSF 2.0 addresses the rise of risk management and governance as an essential task for IT and security teams. While it has existed in previous versions, this elevation to a core function places it in a position of necessary prominence for any organization looking to proactively assess, mitigate, and transfer their cyber risk through risk-driven cybersecurity strategies.

12

In today’s Expert Contributor, Santiago Fuentes, Co-CEO, Delta Protect, underscores Latin America's need to move beyond compliance to true cyber resilience via SOCs, CISO leadership, and continuous testing. Don't miss 'From Compliance to Resilience: The Next Phase of Cyber Strategy': Article Link: https://lnkd.in/gyuSeBVJ Audio Link: https://lnkd.in/gJ4zDSsm Out now! #MBN #MexicoBusiness #ExpertOpinion #AudioArticle

30

🚨 ReliaQuest’s Threat Research team supported the FBI and Cybersecurity and Infrastructure Security Agency (CISA) in their action against LummaC2—a highly active info-stealing malware targeting systems via spearphishing links, attachments, and deceptive CAPTCHAs. The LummaC2 report includes IOCs, tactics, and actionable recommendations to mitigate this evolving threat: 👉 Use least privilege, separate user/privileged accounts, and audit/remove inactive accounts. 👉 Implement phishing-resistant MFA, allowlisting, and keep systems patched. 👉 Monitor logs, detect unusual API usage, and analyze anomalies. 👉 Use segmentation (e.g., DMZ or VPC) to isolate sensitive systems and restrict command-line access. 🔗 Read the report: https://bit.ly/43EkR2O #ReliaQuest #MakeSecurityPossible #FBI #CISA #Cybersecurity

98

2 Comments

"What a better place to perform research and development, than a place that defines our future." -Joshua Sitta, Sittadel Today we signed an agreement with Florida Polytechnic University that will allow Sittadel and Florida Polytechnic University to create a student powered (SOC) Security Operations Center. This will be led by Garrett Poorbaugh who will also lead the research and development arm of the SOC. Stay tuned for the good things to come! This is just one more step closer in realizing our mission of making cybersecurity more accessible. https://lnkd.in/enDxfXZQ #cybersecurity #partnership #sittadel

110

15 Comments

A foreign threat actor infiltrated the Kansas City National Security Campus (KCNSC), a key manufacturing site within the National Nuclear Security Administration (NNSA), exploiting unpatched Microsoft SharePoint vulnerabilities, according to a source involved in an August incident response at the facility. The breach targeted a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons under the NNSA, a semi-autonomous agency within the Department of Energy (DOE) that oversees the design, production, and maintenance of the nation’s nuclear weapons. Honeywell Federal Manufacturing & Technologies (FM&T) manages the Kansas City campus under contract to the NNSA. https://lnkd.in/giNSG9P5

22

1 Comment

You don’t have to be a compliance expert to know that every framework calls for proper network segmentation. PCI DSS, NIST, and ISO all require isolating systems and controlling access to limit exposure. Aside from simplifying how you manage your network, the real goal of segmentation is containing movement once attackers get inside. Recent research from CrowdStrike's Global Threat Report shows that AI-driven attackers can move laterally in as little as 51 seconds. That means you have less than a minute to respond once a breach happens, which makes containment one of the most viable defenses. Segmentation builds the boundaries that stop lateral movement before it spreads. It keeps critical systems isolated, protects regulated data, and gives teams continuous visibility and control across hybrid networks. Watch Erez Tadmor give a full breakdown and access the complete on-demand session here: https://okt.to/OgY5QW

15

2 Comments

Good morning! Here is this week's ICS Advisory, Other CERT, & Vendor Vulnerability Advisories Weekly Summary for 13 – 17 October 2025. See attached or link to Weekly Summary Slides: https://lnkd.in/eHiyeZ3i This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Siemens, Rockwell Automation, & Hitachi Energy. Two updated CISA ICS Advisories were released for Schneider Electric & Delta Electronics. Based on the new CISA advisories, Critical #Manufacturing, #Energy, Commercial #Facilities, #Water & #WastewaterSystems, #TransportationSystems, and #Food & #Agriculture are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 23 new ICS Advisories for Moxa [Industrial Switch, Router, & LTE Cellular Router], Westermo [Operating system], SICK [Baggage System, Smart Service Gateway], LANCOM [Unified Firewalls], Schneider Electric [Energy Management Systems], PHOENIX CONTACT [UPS & AC charging controller], Murrelektronik [PROFINET, compact module], Dassault Systèmes [3D design & lifecycle management software.], Philips [Picture Archiving & Communication System (PACS)], Ashlar-Vellum [3D modeling software], Eaton [Intelligent Power Protector (IPP) software], Ruijie [Wireless Bridge], Delta Electronics [AC Servo Drive Software], & four update for Schneider Electric [EMS, PLCs]. For a more comprehensive understanding, you can view the summary details of other CERT & Vendor product advisories identified last week (13 – 17 October 2025) and read the vendor advisory using the links provided at: https://lnkd.in/eWdPxeAG The ICS Advisory Project identified One KEV Catalog CVEs correlated with a CVE identified in one new CISA ICS Advisory: ICSA-25-289-10 – Siemens HyperLynx and Industrial Edge App Publisher - Google Chromium V8 - CVE-2025-6554, CVSSv3: 8.1. https://lnkd.in/eg5Cbgx7 This past week, Siemens released 21 (6 new, and 15 updated) Security advisories, each with a corresponding CISA ICS Advisory, except for one (SSA-083019). View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides and Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week! #CISA #ot #ics #otsecurity #cybersecurity  #cybersecuritythreats #cybersecurityawareness #industrialautomation #chemical #hydro #oilandgas   Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

22

🚨 CISA Issues Emergency Directive for Critical Microsoft Exchange Vulnerability (CVE-2025-53786) On August 7, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released Emergency Directive 25-02, urging federal agencies to mitigate a serious post-authentication vulnerability affecting hybrid Microsoft Exchange deployments. 🔐 Key Requirements by August 11, 9:00 AM EDT: Inventory all Exchange servers using Microsoft’s Health Checker Disconnect unsupported servers Apply latest Cumulative Updates and security patches Migrate to Microsoft’s new dedicated Exchange hybrid application in Entra ID Prepare to shift from Exchange Web Services to Microsoft Graph API (starting Oct 2025) Submit compliance status to CISA by 5:00 PM EDT, August 11 CISA highlights the complex cyber threat landscape and urges organizations to strengthen basic cyber hygiene—strong passwords, software updates, and multi-factor authentication. #CyberSecurity #MicrosoftExchange #CISA #CVE202553786 #HybridCloud #EmergencyDirective #ThreatMon

15

1 Comment