Corey Thomas

Holy big acquisitions! Palo Alto Networks acquires CyberArk for a cool $25B. Nikesh Arora and Udi Mokady join Jim Cramer on Mad Money to discuss why he needed to make this move, Arora stated, "I've always paid attention to markets when they inflect, because inflection points create the opportunity for us to enter markets and provide our customers differentiated services. And I believe with the #AI wave we're seeing all around us, with 88% of all ransomware attacks driven by credential theft, identity is an unsolved problem" https://lnkd.in/gE3kbYXC Brenna Karr, Nicole Hockin, Ashley Vandiver, Mike R., Sharon Vaughan

97

1 Comment

Not every threat shows up on a dashboard. Some live in the gaps your compliance reports don’t cover. Most teams rely on policy. But risk hides in execution. These 5 threats often go unnoticed. These aren’t edge cases. They’re the blind spots most systems tolerate—until it’s too late. Guardium is built to surface what legacy tools overlook.

149

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

35

Our latest Rapid7 vulnerability disclosure details 8 new vulnerabilities in Brother Printers which affects 742 models across 4 vendors. The disclosure including details of content coverage for Rapid7 customers is available here: https://lnkd.in/e832gVjb H/T Stephen Fewer A summary of these vulnerabilities are detailed below:

115

2 Comments

Your network can be your differentiator in the cybersecurity field. Don't wait for opportunities to find you—create them by reaching out and connecting with others! Tune into the latest episode of the Shared Security Podcast where I chat with Katie Soper from Avetix Cyber. We discuss the myths, realities, and the hidden challenges going on in the industry. Perfect for anyone hiring, aspiring to break into the field, or already thriving in cybersecurity. Links below!

28

5 Comments

CyberArk's new leadership team is playing for keeps. Their moves in FY'24 made it abundantly clear they're not just going to sit on their market leadership in PAM. CyberArk is after all of identity. Hitting $1 billion in both ARR and top line revenue is a big milestone, but we knew that was going to happen months ago. The bigger story of CyberArk's Q4'24 earnings report is new market entry. They went after machine identity by acquiring Venafi, and now they're going after IGA with Zilla. Going into 2025, CyberArk is now competing in markets that were historically off limits. It's a new era of identity competition going forward. Here's my interpretation of CyberArk's strategic rationale across both deals: → The short version: they had to choose between betting big on machine identity or IGA. I'm sure they knew they were going to make acquisitions in both machine identity and IGA this year. The bigger question was which market made more sense to buy a scaled company. → Machine identity made more sense for a large acquisition. CyberArk had options. They could have spent $1B+ and acquired one of a few scaled IGA companies and acquired one of several early-stage machine identity companies instead. I get their logic. Venafi is the leader in machine identity for enterprise. They probably have 20x (or more) revenue scale than the early stage alternatives. And they're a natural extension of CyberArk's established secrets management (Conjur) business. Meanwhile, some of the scaled IGA companies were long since displaced by SailPoint, Saviynt, and others. It's hard for CyberArk to justify paying $1B+ and hoping the brand would make the asset competitive again. Their bet is that machine identity is inflecting. Better to pay up there, buy the market leader, and spend less on next-gen IGA. → CyberArk still needed a competitive IGA product even though they bet on machine identity. CyberArk's customers are enterprise and upper middle-market. Their IGA product had to be enterprise-grade. More specifically, it had to be good enough to beat Okta's new IGA product. This meant paying a healthy premium ($165M +$10M earnout on $5M ARR, a ~33x multiple). But Zilla was likely the best value compared to ultra-premium alternatives, who I'm sure were asking $250M+. Here's the kicker: Even though CyberArk *wants* to be competitive against SailPoint and Saviynt, I don't think they have to be. Beating Okta's IGA product, fending off their PAM market entry, and holding a top three overall position in the converged workforce identity market easily justifies the ~$165M spent on Zilla. --- CyberArk bet on owning machine identity while maintaining IGA competitiveness rather than trying to disrupt the established IGA leaders. The long game here is being among the top companies in both workforce and machine identity.

164

17 Comments

PCI SSC Updates SAQ A for PCI DSS v4.0.1 – Key Changes for E-Commerce Merchants The PCI Security Standards Council (PCI SSC) has announced key modifications to Self-Assessment Questionnaire A (SAQ A) in response to stakeholder feedback on the complexity of implementing PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1 for e-commerce security. Key Updates: ✅ Removal of PCI DSS Requirements 6.4.3, 11.6.1, and 12.3.1 from SAQ A. ✅ New Eligibility Criterion: Merchants must confirm their site is not vulnerable to script-based attacks. ✅ SAQ A (January 2025 version) is now available, taking effect on 31 March 2025. ✅ October 2024 SAQ A version will be retired on 31 March 2025. More details: https://lnkd.in/ggzr_ehQ #PCIDSS #EcommerceSecurity #Compliance #Cybersecurity

25

2 Comments

I've been noticing what could be an interesting problem with #SBOM presentations, but I could use a second opinion These presentations are very very complicated now Probably 5-10 years ago there were plenty of "what is an SBOM". That makes sense, they were new Now presentations about advanced SBOM topics. Things like attestation, AI materials, encryption, and more. But there's still an audience for the beginner content I think. As we are seeing many compliance standards adopting SBOMs, I suspect there's a definite need for "what is this thing" sort of material Or am I missing something? Have other industries been through this sort of evolution?

36

31 Comments

The top three security threats are the usual suspects: email phishing, third-party risk, and security negligence.  Our 2025 State of Cybersecurity Report shows that hackers are looking to siphon Advanced PII because it allows them to focus on long-term exploitation.  📌 Find out where other security threats land in the standings: https://lnkd.in/g8ThRcha #SOCR #Cybersecurity #CyberResilience

65

1 Comment

I wrote a response to JPMorganChase CISO Pat Opet's open letter. SaaS vendors are still ignoring basic security for API keys, tokens, and service accounts. There's no logging. No revocation. No visibility. These are the identities that power third-party integrations, and attackers are targeting them. Security should be built-in, not an upgrade. Read the post here: https://go.clut.ch/JPMC

43

1 Comment

In pursuit of sustaining their success, MDR providers now offer a wild mix of services that sometimes make MDR better and other times just satisfy investors chasing growth. Jess Burn and I just released a new blog and report categorizing services based on whether they augmented, distracted, or destroyed the value of an MDR service. Read the blog here: https://lnkd.in/eMGCuiVm

59

7 Comments

2025 will be a defining year for external threat intelligence. Having observed trends with CybelAngel for the past year, I’ve noticed: ☑️ Ransomware threats are on the up: CybelAngel detected a 42% rise in reported attacks. ☑️ AI is fueling cyber attacks: Since ChatGPT’s arrival, phishing emails have increased by 1,265%. ☑️ API exposure is rising: We’ve seen a 625% increase in API exposure losses since 2021. ☑️ APT groups are mobilizing: Nation-state sponsored threat actors are more active and creative than ever. In our 2025 report, I have unpacked key insights into cyber threats for 2025, along with best practices and recommendations for #CISOs to fight back. Read it here: https://bit.ly/3WSrXwW

53

2 Comments

Every organization needs an effective threat detection solution to withstand today's increasing cyberattacks. But is an MDR or EDR solution the best way to go? Discover the benefits and challenges to each approach, and determine which makes sense for your business on your journey to achieve an ideal security posture.

29