Chirag Shah

I recall getting lost in awe at Leke’s barbershop - was it the dexterity in his craft (he was one-hand) or at people dozing off while he reformed their looks?… Well, I recently almost fell off the chair myself. That moment was different. Nobody prepares you for the quiet fatigue that comes with leadership, especially when you're the one everyone looks to for clarity, speed, and direction. As a team lead, it’s easy to slip into “maintenance mode”: ✔️ Morning syncs ✔️ Back-to-back meetings ✔️ Progress tracking ✔️ Firefighting ✔️ Reporting ✔️ More meetings You start cutting out “distractions” like breaks, social catch-ups, or rest-only to end up running on fumes. Leadership isn't just about ensuring deliverables are met. It’s about carrying the emotional weight of the team, keeping morale up, and still showing up with energy. Balance isn't a myth—but it has to be intentional. Rest is part of the strategy. Burnout helps no one. So, if you’re in leadership and running on autopilot, this is your reminder: Recharge. Reflect. Reset. Even leaders need care too.

34

7 Comments

The CIS Risk Assessment Method on Salesforce Trailhead is a solid framework for aligning cyber safeguards with real business and regulatory impact. Highly relevant for financial institutions and credit unions working toward FFIEC and CIS Controls alignment. #CyberRisk #CISControls #Governance #CreditUnions

50

4 Comments

🦔 #Oracle is reportedly considering cutting 20,000 to 30,000 jobs and potentially selling Cerner, its healthcare IT unit, to fund its $300 billion contract with OpenAI. Investment bank TD Cowen estimates the OpenAI deal alone requires $156 billion in capital spending for GPUs and infrastructure. Oracle's credit default swap spreads have tripled, signaling Wall Street sees increased risk of default or liquidity stress. The company is now reportedly requiring 40% upfront deposits from customers to secure cash flow. US banks have pulled back from lending on Oracle-linked datacenter projects. Oracle bought Cerner for $28 billion in 2022 to pivot toward healthcare data. Selling it now would be a stunning reversal. Author’s Take I've been writing about the circular dependencies in AI infrastructure for months. Nvidia sells chips to companies building data centers. Those companies sign contracts with OpenAI. OpenAI pays with money raised from investors. Everyone's balance sheet depends on everyone else's continued access to capital. Now we're seeing what happens when one link in the chain starts to buckle. Oracle signed a $300 billion contract that requires $156 billion in capex. Debt investors are spooked. Banks won't lend. So Oracle is considering laying off 30,000 people and selling a profitable business it bought three years ago just to generate the cash to keep building data centers for a company that burns $9 billion a year and doesn't expect profitability until 2029. Oracle paid $28 billion for Cerner. Now they might have to sell it to feed the AI machine. Hospitals rely on Cerner's software to function. The people who might lose their jobs aren't the ones who made this deal. Larry Ellison made the bet. Workers and healthcare systems absorb the consequences. This is what happens when companies mortgage their existing businesses to chase AI infrastructure buildouts they can't actually afford. Hedgie🤗 https://lnkd.in/gKYW5_4h

32

1 Comment

Artificial Intelligence — The Problem, The Solution, or Both? Last week, I had the privilege of speaking as a panelist at the 3rd ACFE National Fraud Conference 2025. The discussion was dynamic, thought‑provoking, and centered on one of the most pressing questions facing our industry today: Is Artificial Intelligence (AI) the problem, the solution, or both? AI as the Solution On the upside, AI offers capabilities that were unimaginable a decade ago. Machine learning models can process vast amounts of data in real time, spotting anomalies and predicting fraud patterns faster than any human team. For organizations battling increasingly sophisticated fraud schemes, this is a game‑changer. Instead of relying on outdated, rule‑based systems that react after damage is done, AI enables proactive defense. It learns, adapts, and evolves. It can flag suspicious activity before risks materialize, giving businesses the chance to act decisively. In a world where trust is currency, AI helps organizations protect both their bottom line and their reputation. AI as the Problem But here’s the catch: the same technology that empowers defenders also arms attackers. Generative AI has made it easier than ever to create convincing phishing emails, deepfakes, and synthetic identities. Automated attacks can exploit vulnerabilities at a speed and scale we’ve never seen before. In other words, AI doesn’t just level the playing field—it raises the stakes. Fraudsters are no longer limited by human capacity; they can weaponize AI to launch attacks that are faster, smarter, and harder to detect. This duality means we’re not just fighting fraud—we’re fighting AI‑powered fraud. Finding the Balance So where does that leave us? For CISOs, Fraud Risk leaders, and anyone responsible for safeguarding digital ecosystems, the challenge is clear: leverage AI responsibly while mitigating its unintended consequences. That requires three things: Robust governance frameworks: Clear policies and ethical guidelines for AI deployment are non‑negotiable. Transparency and accountability must be built into every system. Continuous monitoring: AI is powerful, but it’s not perfect. Biases, blind spots, and vulnerabilities can creep in. Regular audits and monitoring are essential to keep systems trustworthy. Collaboration across industries: Cyber threats don’t respect borders or sectors. Sharing intelligence and best practices across industries strengthens collective defenses. A united front is far more effective than isolated efforts.   Final Thought AI is neither purely the problem nor solely the solution—it’s both. The organizations that succeed will be those that recognize this duality and act decisively. Embracing AI with responsibility, foresight, and collaboration is the only way forward. The question isn’t whether AI will shape the future of fraud prevention and cybersecurity—it already is. The real question is: Will we rise to the challenge of using it wisely?

57

2 Comments

New data shows some U.S. metro areas are significantly more at risk for cyberattacks... and it's not where you'd always expect. Frontegg's Digital Risk Index flags Fresno and the Riverside-San Bernardino-Ontario region among the most vulnerable, seeing very few cybersecurity professionals per capita. Washington, D.C., meanwhile, faces the highest rate of unfilled cybersecurity positions. Cities like Los Angeles, San Francisco, and Fresno also rank high because of dense tech, healthcare, and finance sectors - industries that expand faster than defenses. Washington, D.C. tops the list when it comes to breach volume per resident, followed by Massachusetts and Oregon. That kind of structural mismatch between risk and readiness underscores how geography and workforce shape cyber resilience across industries. #Cybersecurity #RiskManagement #Workforce

14

1 Comment

Verizon DBIR 2025 is out. https://lnkd.in/guRBRcAJ https://lnkd.in/gjSMwkDP 3rd Party breaches increased Vulnerabilities exploit as initial vector increased by 34% and accounted for 20% of breaches. 54% of perimeter devices - MTTR 32 Days (Mean Time To Remediate) Human factor accounted for 60% of cyber security weakness. Interesting read of the use of GenAi threats.

36

2 Comments

Thrilled to share my first published article in TechGraph — “When Cybersecurity Tools Break the System: The Hidden Risk Behind Digital Defenses.” In this piece, I explore a critical but often overlooked challenge in cybersecurity: how the very tools we deploy to protect digital systems can, when misconfigured or flawed, trigger widespread operational failures and cascading disruptions across industries. Drawing on real-world incidents, the article highlights the need for resilient deployment practices, staged rollouts, multi-vendor strategies, automated testing, and robust incident response planning. It’s an important conversation for security leaders and enterprises striving to build defenses that protect without destabilizing the systems they serve. https://lnkd.in/gC5d_6Ym #Protective technologies # Cyber Security # Cyber Safe

49

3 Comments

PAM just shifted from a compliance checkbox to an emergency control layer. Everyone talks about PAM like it's just vault and rotate credentials. It's not. The real threat is what's happening with machine identities and autonomous AI agents. Here's what changed in the last 12 months: 1. Agentic AI broke traditional identity assumptions Gartner estimates 40% of enterprise applications will integrate AI agents by 2026. That's up from under 5% in 2025. These agents don't behave like service accounts or scripts. They reason, plan, and execute multi-step actions across your entire environment. When compromised via prompt injection, they become high-speed insider threats with admin rights. Example: Organizations now have anywhere from 1 to 17 AI agents per employee. Most don't even know how many exist. 2. Machine identities outnumber humans 82:1 Non-human identities (service accounts, API keys, certificates) have grown over 40% year-over-year. Some enterprises hit ratios of 144:1. The problem is not the count. The problem is that most of these identities have standing privileges, excessive permissions, and zero lifecycle management. According to Unit 42's 2025 report, 66% of social engineering attacks specifically target privileged accounts. Threat actors can move from initial access to full domain admin in under 40 minutes. 3. Legacy PAM tools cannot scale to this Traditional IAM and PAM were built for predictable human behavior and static machine identities. Agentic AI violates every assumption. Agents spin up ephemeral sessions, create sub-agents, and act across multiple principals. OAuth and SAML are not designed for peer-to-peer trust establishment between autonomous agents. What this means for your security architecture: -Shift from securing identities that use AI to securing identities within AI systems -Implement Just-In-Time access and zero standing privileges for all non-human identities -Apply least privilege enforcement with automated expiry policies and kill switches -Deploy AI-powered behavioral analytics to detect privilege escalation in real-time -Treat every AI agent as a privileged user by default The first major breach starting with an AI interface and resulting in privilege escalation is not a question of if. It's when. Given the below evidence, here are my recommendations: Audit your non-human identity inventory now. If you can't list every AI agent, bot, and service account operating in your environment, you have a blind spot. Implement JIT access controls for machine identities. Apply session monitoring and automated threat detection for autonomous agents. How are you securing AI agents in your environment? #PrivilegedAccessManagement #IdentitySecurity #AgenticAI #ZeroTrust #CyberSecurity

19

1 Comment

Reflecting on my experience with numerous early-stage companies, I'm reminded of the timeless insights from Geoffrey Moore's book, "Crossing the Chasm." Despite reading it during my master's program at the University of Texas years ago, its lessons remain profoundly relevant, especially for Cyber Security startups. 1. **Market Validation:** Understanding Customer Segments and the Chasm - **Technology Adoption Lifecycle:** Identifying five customer segments: - Innovators: Driven by technology, eager to experiment. - Early Adopters (Visionaries): Seek competitive advantage, embrace risks, and influence others. - Early Majority (Pragmatists): Crucial for mainstream success, risk-averse, rely on proven solutions. - Late Majority (Conservatives): Adopt when necessary or standard. - Laggards (Skeptics): Resistant to change, adopt under compulsion. 2. **The Chasm:** A critical gap between Early Adopters and the Early Majority. While early adopters accept imperfections, pragmatists demand reliability. Failure to bridge this gap results in growth stagnation and market setbacks. 3. **Defining a Target Market (Beachhead):** Companies must select a specific, narrow niche market (a "beachhead") before crossing the chasm. This niche should: - Be sizable enough to drive significant growth. These fundamental principles are paramount for any new venture's success. Targeting everyone equates to targeting no one. Focus on growth drivers at the opportune moment. #CrossingtheChasm #Startup #Venture

15

6 Comments

Just wrapped up the National Credit Unions Directors conference organized by CU Conferences. Wearing two hats—as a Board Director and as a CISO—I found the sessions especially valuable in bridging governance and security with strategy and member impact. A few takeaways that resonated with me: Mindset drives outcomes: Whether it’s frontline staff shaping member experience or leadership shaping culture, the right mindset fuels growth. Thanks for the great insights, Dave Won! Boards must be active stewards: From fiduciary responsibilities to understanding financial risks, governance is about leaning in—not just oversight. Community and inclusion are growth engines: Credit unions that embed themselves in their communities and embrace inclusivity build deeper trust and stronger performance. Risk and resilience connect strategy: Internal controls and risk indicators aren’t just compliance tools—they inform long-term strategy, something I see daily as a CISO. Grateful for the chance to represent Citadel Credit Union alongside my fellow volunteers, Jessica Schuler and Brian O'Neil and bring back insights that will shape both my board work and my security leadership.

115

7 Comments

Zero Trust in BFSI: Securing Trust Where It Matters Most. In the face of rising cyber threats, BFSI leaders must see Zero Trust not as a tool, but as a strategic framework to protect trust, meet compliance and maintain competitive edge. In an environment where every transaction, customer record and regulation matters, legacy perimeter defenses are no longer enough. Zero Trust shifts the paradigm: assume nothing, verify everything—anytime, anywhere. Key Pillars of Zero Trust: - Elimination of implicit trust - Enforcement of least-privilege access - Implementation of continuous monitoring The imperative for Zero Trust adoption in the BFSI sector: - Rising API-based and insider threats within fintech ecosystems - Growing complexity in access management due to remote advisors, traders and back-office teams - Regulatory requirements demand auditable security controls - Upholding customer trust and safeguarding brand reputation In addition, Micro-segmentation, a pivotal component of Zero Trust, restricts lateral movement within the data environment; if one workload is compromised, the rest remain isolated. Adopting Zero Trust is becoming crucial not just to safeguard assets, but to future-proof security in a hyper-connected environment. Cyber security must evolve alongside the expanding digital landscape and Zero Trust provides the resilience needed to face emerging challenges. #BFSISecurity #CISO #ZeroTrust #CyberResilience #GRC #RiskManagement

41

3 Comments

WARNING ABOUT FRAUD ATTEMPT: I received a phone call that said it was from my credit card (PenFed)...the number was correct area code for PenFed and showed up on my phone as "PenFed." The caller said that they were the fraud department and asked if I had made a purchase for $299 from Tencent. I said no. They asked if I had called the fraud department, and I said no. They said that a woman had called claiming to be me, but she could not answer any questions correctly, so they assumed it was a fraudulent call and were calling me directly. They then told me my address and asked me to confirm. Address was correct. They then did the same with phone number - only they had my husband's phone number. They then confirmed my email address and said that I should receive a 6-digit code to confirm with them via that email. I received an email, but it was NOT from PenFed address, so I refused to give them the code. They asked if I had another email address where I could receive a code. The weird email address and that question for alternative email were the clues....and I said that I was hanging up and would call PenFed directly. They then tried to call me three times in a row. I called my husband, and he had received a 6 digit code on his cell. We then called the PenFed fraud number (from back of card) directly...and learned that they had never reached out to me. It was a pretty good attempt honestly, and I have been in cybersecurity for over 2 decades. They had my card information, address, phone numbers, email. They simply needed a code (perhaps MFA bypass or one of the random codes that I sometimes get when making some purchases online), and they were pretending that it was a security code to verify my identity. Had I not double checked the email itself, it would have been easy enough to just provide them with the info. The lesson - back to basics - just hang up and call the number on the back of your card directly. Don't call the number that called you. Don't feel pressured by the urgency of potential fraud. Change password if this happens to you (make it unique, long, strong, and store it in a password manager). Friendly reminder for all of us - and pass this on to your family members!

250

25 Comments