Parthiv Shah, CISM, CISSP

2025 is shaping up to be the year of IT compliance ✅ 📋 💣 CRA, PLD, DORA, SSDF updates—if you're compliance-adjacent, it's been absolutely wild. A new standard or update seems to drop every other week. But here's the thing that's actually changing: SBOMs are now mandatory and compliance isn't an annual ritual anymore. The CRA demands SBOMs for every release, stored for 10 years. PCI-DSS 4 requires vulnerability scans at least every three months. This means evidence collection is now continuous. When you do something once a year, you can wing it with manual effort. When you do it every day, you need automation. You need DevOps thinking applied to compliance requirements. That's where CompOps comes in—think DevOps, but for continuous compliance. Your DevOps team already knows how to solve these problems. They've been building resilient, repeatable systems forever. Compliance requirements are just another set of requirements they can architect solutions for. But security teams need to be cautious. They are used to being the star during a crisis. If they show up and declare everything will be fine because security is here, they will lose before the compliance program has even got started. The future of compliance means working with your DevOps team as a trusted partner, not showing up as the hero. I wrote about how to actually make this work (and why in a few years we won't even talk about CompOps anymore—it'll just be part of the workflow): https://lnkd.in/g4QSFY4P #Cybersecurity #CompOps #DevOps #Compliance #SoftwareSupplyChain

11

1 Comment

NYDFS Acting Superintendent Kaitlin Asrow just named the priorities every security leader should track: AI-accelerated threats, cryptocurrency, cybersecurity, and third-party risk. The updated 23 NYCRR Part 500 rules are fully in effect. But regulation alone won’t close the gap between governance documentation and runtime reality. WHY THIS MATTERS NOW The threat evidence has moved past theoretical. Anthropic documented GTG-1002, a Chinese state-sponsored actor whose agentic AI autonomously executed 80-90% of an espionage campaign while humans only intervened at strategic decision points. Google GTIG tracked state actors from China, Iran, North Korea, and Russia, integrating AI across the full attack lifecycle to identify malware families like PROMPTFLUX that call LLMs during execution to dynamically generate and obfuscate code. The criminal AI tooling marketplace has matured. Threat actors operate across the full autonomy spectrum. Defenders must govern accordingly. HOW TO CLOSE THE GAP Every AI agent needs a defined autonomy tier: fully autonomous, human-on-the-loop with intervention triggers, or human-in-the-loop with explicit approval gates. Business risk determines the tier. Agent Cards should serve as governance artifacts defining scope, permissions, data boundaries, and behavioral constraints before deployment. Assign human owners with explicit accountability. Enforce least privilege rigorously. If an agent doesn’t need access, it doesn’t get access. CTEM provides the feedback loop connecting governance to runtime. When threat actors exploit vulnerabilities at machine speed, annual assessments are insufficient. CTEM continuously validates controls against current attack patterns, not last quarter’s assumptions. Zero Trust must extend to AI itself. Never implicitly trust agent output. Verify scope continuously. Monitor behavioral drift. Enforce segmentation between AI workloads and sensitive data. WHAT NEEDS TO CHANGE Third-party risk must evolve beyond questionnaires. Asrow emphasized this. JPMorgan CISO Pat Opet’s open letter reinforced it. The conversation must extend to fourth-party dependencies and software supply chain integrity: model provenance, training data lineage, API dependencies, and runtime behavior monitoring all require continuous assurance. The frameworks exist: NIST AI RMF, CSF 2.0, ISO 42001, MITRE ATLAS, OWASP AI Security, CSA AI guardrails. The gap isn’t availability. It’s operationalization and the discipline to treat AI governance as continuous rather than a compliance milestone. Build governance that scales as autonomy increases. Define the tripwires. Prove that the humans showed up when required. The regulatory pace is accelerating. The threat actor pace is faster. #Cybersecurity #AIGovernance #CTEM #ZeroTrust #ThirdPartyRisk​​​​​​​​​​​​​​​​ https://lnkd.in/eU83nN8i

6

1 Comment

The ShinyHunters breach claim against the FBI is a wake up call, and not for the reasons most people think. The group says it targeted the FBI in retaliation for a public advisory detailing their methods. Shiny Hunters claims it has data of thousands of FBI employees (according to the group's claim it has data of "almost ALL FBI agents and job applicants". Reported impact: data on thousands of agents and job applicants is at risk, and the FBIjobs.gov applicant portal pulled offline while the Bureau investigates. Here is what stands out to me as a security leader: ·      The vector is human, not a zero day. ShinyHunters is known for vishing, credential theft, and abusing SaaS platforms like Salesforce. ·      SaaS is the new perimeter. A careers portal became the entry point, and even the mighty FBI got compromised. ·      Retaliation is a real threat model. The lesson is not that the FBI got hit. It is that the same low tech, high impact playbook works against almost everyone. Where is your human layer strongest, and where is it weakest? #CyberSecurity #CyberDefense #InfoSec #ThreatIntel #CISO #DataBreach #CyberResilience

12

2 Comments

Scam Industry Statistics, as cataloged by the The Aspen Institute Financial Security Program “Being tricked by a scammer to send money or provide access to a financial account is the second-largest crime concern in the U.S.—57% of adults worry about it.” (Only identity theft, with 72% worrying about it, ranks higher than scams.) SCAMS IMPACT ALL OF AMERICA * 20% of U.S. adults have lost money in a scam attack * 75% of scam attack victims never reported to law enforcement * 70% of scam attack victims reported losses directly to their financial institution * $158 billion in scam attack losses (estimated based FTC/FBI loss reports and under-reporting PHONE CALLS, TEXTS, EMAIL, SOCIAL MEDIA, FINANCIAL SYSTEMS ARE AT RISK *68% of U.S. adults receive daily or weekly scam messages though phone calls (68%), email (63%), text (61%) and social media (33%) *60% of Americans say online scams are a “major problem” on text, phone, email, social media; roughly half say the same about banking, shopping, and payment sites/apps *41% of U.S. adults (106 million) gave personal information in a scam call, text or email SCAMS ARE A NATIONAL SECURITY THREAT Scam criminal activity threatens the United States, as perpetrated by Transnational Criminal Organizations (TCOs), national-state affiliated groups (North Korea, Russian crime syndicates, Triad gangs (Chinese organized crime syndicates) and Mexican drug cartels). The Scam Industry now rivals the illegal drug trade. Citations in page 2 of this PDF >https://lnkd.in/eGvVCWAe

8

5 Comments

CISA Warns of Motex LANSCOPE Endpoint Manager Vulnerability Actively Exploited in the Wild CISA has issued a critical alert regarding a severe vulnerability in Motex LANSCOPE Endpoint Manager, a popular tool for managing IT assets across networks. Dubbed an improper verification of the source of a communication channel flaw, this issue allows attackers to execute arbitrary code simply by sending specially crafted packets. The vulnerability, tracked under CVE-2025-61932, has already been exploited in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog. Organizations using the software are urged to act immediately to prevent potential breaches that could lead to data theft, ransomware deployment, or full system compromise. This warning comes amid a surge in endpoint management exploits, as cybercriminals increasingly target administrative tools to gain deeper network access. https://lnkd.in/edpPWJtx Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

3

1 Comment

Cybersecurity isn’t just an IT issue — it’s a fiduciary responsibility. The ‘NIST IR 8286r1’ helps bridge the gap between technical operations and the boardroom by integrating cyber risk into Enterprise Risk Management (ERM). Here: -> https://lnkd.in/gsXi5Vta This reframes the conversation: From vulnerabilities to business impact From technical metrics to financial exposure From reactive spend to risk-informed strategy A single ransomware event can cost millions of $ in downtime, legal, and reputational impact. That’s enterprise risk. Leadership starts with aligning cyber risk to mission objectives and enabling data-driven decisions at the board level.

119

5 Comments

Over the last few audit cycles, I’ve noticed a recurring pattern. Security teams are not failing audits because they lack controls. They struggle because discussions derail into terminology instead of intent. Black-box. White-box. Grey-box. These labels dominate meetings, yet when you go back to the actual regulatory text, something interesting emerges. Regulators are far less concerned with how you label testing. They are deeply concerned with what you test, how often, who tests it, and what you do with the findings. RBI focuses on discipline. Frequency. Independence. Lifecycle coverage. Governance. SEBI focuses on visibility. External exposure. Internet-facing systems. Application security through runtime and code-level testing. Neither regulator mandates marketing language. Both mandate defensibility. The most successful audit conversations I’ve seen recently are the ones where teams stop arguing methodology names and start demonstrating: • Clear scope rationale • Technique-to-risk mapping • Evidence of remediation and re-testing • Independence of assessment When you shift the discussion from labels to outcomes, the room changes. Compliance becomes collaborative. Audits become constructive. Security teams regain control of the narrative. Curious to hear from others in security and compliance roles. What has helped you move audit conversations from terminology debates to risk-based alignment? #CyberSecurity #AuditReadiness #RegulatoryCompliance #RBI #SEBI #InfoSec #SecurityLeadership #RiskManagement #VAPT #Governance

3

1 Comment

Can you show how your risk assessment influenced a cybersecurity decision and why you had a good reason to rely on it? New York State's Department of Financial Services' September 10 guidance says assessments must inform and support decisions about controls, compensating controls, and risk acceptance. The Department expects covered entities to demonstrate that connection. From a Defensible Risk Assessment perspective, this brings us to "reasonable reliance": ❓Is the assessment sufficient for the decision we are asking it to support? ❓What evidence supports the conclusion? ❓Does the assessment cover the relevant exposure? ❓How did the findings influence the response? Those are my Defensible Risk Analysis (DRA) questions, not a new DFS test. The guidance expressly creates no new obligations. Before your next significant cyber decision, ask: Can we explain why we are relying on this assessment? Read the DFS guidance: https://lnkd.in/eGKhpDWt #CyberRisk #DefensibleRiskAssessment #DRA

1

TL:DR: The DoW officially issues guidance to contracting officers to remove references to independent assessment requirements and primes lose their ability to flow down certification requirements to subs. We are not expecting to hear anything after the 60-day review of CMMC concludes, as the output is simply recommendations, which will likely remain internal until direction is solidified.

15