Sherrod DeGrippo

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

Your #EDR Healthcheck doesn’t end with findings — it drives measurable outcomes. ✔️ Maximize ROI: Benchmark performance before renewals or migrations. ⚡ Accelerate response: Correlate attacks with logs for faster tuning. 🧾 Prove compliance: Map real evidence to SOC 2, NIST, and CIS frameworks. That’s how leading teams transform EDR validation into business value. 🔗 Turn validation into outcomes: https://lnkd.in/g--XVzre #EndpointSecurity #OffensiveSecurity #pentesting

14

Modern attacks move fast. Your defenses need to move faster. Today’s hybrid attackers operate across domains, leverage identities, and bypass traditional tools with ease. In our latest report, we break down how AI is being applied to detect, prioritize, and disrupt these sophisticated threats before they escalate. Download your copy: https://lnkd.in/eFQy6UDG

16

Research shows that offensive security practices like red teaming and pen testing reduce the frequency and cost of security incidents. Unfortunately, not everyone understands this, so CISOs and SecOps leaders must work to get executive buy-in. Our new guide helps you build a practical business case, overcome objections, and outline an investment roadmap for offensive security. Read the CISO's Guide to Justifying Offensive Security Investments: https://ow.ly/e2n650WVuW8 #OffSec #CISO #Cybersecurity

23

A foreign threat actor infiltrated the Kansas City National Security Campus (KCNSC), a key manufacturing site within the National Nuclear Security Administration (NNSA), exploiting unpatched Microsoft SharePoint vulnerabilities, according to a source involved in an August incident response at the facility. The breach targeted a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons under the NNSA, a semi-autonomous agency within the Department of Energy (DOE) that oversees the design, production, and maintenance of the nation’s nuclear weapons. Honeywell Federal Manufacturing & Technologies (FM&T) manages the Kansas City campus under contract to the NNSA. https://lnkd.in/giNSG9P5

22

1 Comment

You might be feeling frustrated by the endless struggle of getting Sigma detection rules to work seamlessly in your open-source SIEM stack. It probably feels like every new rule demands manual conversions, special configs, and a ton of guesswork. It can be exhausting--and I’ve definitely been there. In this walkthrough I introduce how we can incorporate Velociraptor DFIR to solve our Sigma challenge. I share how I set up automated scans, tackled noisy detections, and fed alerts into my incident-response workflow (CoPilot). https://lnkd.in/gX5-X_mN

90

3 Comments

Threat modeling platforms can often look strong in early demos—fast setup, clean workflows, bold AI claims. What’s harder to assess upfront is whether those platforms will scale as architectures grow, teams expand, and threat modeling becomes an operational practice. The 2026 Threat Modeling Buyer’s Guide helps threat modeling teams evaluate solutions based on long-term fit. If you’re evaluating platforms, this guide is for you. 👉 Get the guide: https://lnkd.in/e55dsxnh 

24

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana W. for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

214

19 Comments

🔍 Adaptive Exposure Management (AEM) shifts the paradigm in cyber defense - from visibility to elimination of attacker opportunities. With AEM, your team gains: - Prioritized insights into the exposures that matter most - Continuous monitoring of misconfigurations and control gaps - Automated protection via AMTD for systems you can’t patch right away This datasheet explains how Morphisec turns exposure into defense. Want to learn more? Check out our platform overview: https://hubs.ly/Q03LwhVp0 Follow Alexei Rubinstein, Brad LaPorte, Jayakumar Kurup, CISSP, Michael Gorelik, Richard Benigno, and Ron Reinfeld for more cyber updates!

19

Ready to put your defenses to the test? Our new CDRGoat Getting Started Guide makes it easy to validate your detections against realistic, cloud-native attack chains. Deploy vulnerable environments, execute automated adversary simulations, and test your detection coverage in minutes. 🐐 Read the full guide and explore scenarios on GitHub: https://lnkd.in/g9ZtEybf ⏱️ Stay tuned for a scenario play-by-play, coming soon! David Moss Petr Zuzanov

30

2 Comments

Your attack surface is constantly expanding across on-prem and cloud, and so are the risks. Exposure Command gives you full attack surface visibility with threat-aware context, so you can uncover your riskiest exposures, think like an attacker, and act with confidence. See how it works: https://r-7.co/3TVhcbz

43

Cyber threats evolve fast. Your response should be faster. 𝗖𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀 𝗧𝗵𝗿𝗲𝗮𝘁 𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 (#CTEM) gives security teams real-time visibility into risk, helping prioritize the exposures that matter most. By aligning threat intelligence, asset awareness, and business context, CTEM enables proactive risk mitigation and smarter security decisions. Learn more about CTEM, why it matters, and how to implement it effectively: https://lnkd.in/dNgdRzCY #threatexposure #threatmanagement

17