About
Articles by Jeffrey
Activity
13K followers
-
Jeffrey W. Brown shared thisThe 2026 Microsoft Digital Defense Report is out, and it is NOT about how AI is changing everything we know about cybersecurity. It's really about how AI is changing the clock. Attackers are faster. Automation is cheaper. Social engineering scales better. AI agents introduce new identities, privileges, tools and paths to data. But underneath all of that shiny new machinery, attackers are still walking through some painfully old doors. A few numbers jumped out at me: • Newly exposed cloud workloads were attacked in an average of 5.3 hours. • 52.2% of valid-account intrusions involved additional credential theft. • Microsoft detected more than 46 million business impersonation attacks over the past year. • Microsoft is analyzing roughly 31 million identity risk detections daily. If there's a lesson buried in those numbers, it's that trust itself has become the attack surface. We spent years thinking about "identity as the new perimeter." That was directionally right, but the problem is much bigger. We have human identities, service identities, application identities and increasingly agent identities. Those agents can access data, call APIs, invoke tools and take actions. That means an AI agent with excessive privilege is not primarily an “AI problem," it's really an identity problem... An agent retrieving information it should never have seen is a data-governance problem... An agent chaining tools and exceeding its authority is an access-control problem... AI adds speed, scale and autonomy, but it doesn’t change the need for solid fundamentals. That may actually be the most encouraging part of the report. We don't need to reinvent cybersecurity from scratch, we need to get much better at the things we already know matter: strong identity, least privilege, governed data, visibility across systems, rapid exposure reduction and the ability to keep operating when prevention fails. AI doesn’t let us skip the fundamentals. It exposes where we were kidding ourselves about having them under control in the first place. That’s the conversation I’d be having with boards and executive teams. Read the full report at: https://lnkd.in/gndqdTWQ #Cybersecurity #AI #AISecurity #IdentitySecurity #Resilience
-
Jeffrey W. Brown shared thisSecurity leadership is about more than knowing technology. It’s about earning trust, helping customers navigate hard decisions, and building teams that can deliver. Saira Mohammed is growing her Microsoft Security Americas team with two new opportunities. If you're a former CISO with vertical expertise and that kind of work sounds like you (or someone you know) take a look at the roles in her post and pass them along!Jeffrey W. Brown shared thisOne of the most rewarding parts of leadership at Microsoft is building high-performing teams in a culture that values growth, autonomy, and continuous learning. I’m thrilled to share two new opportunities on my Americas Team! Both roles provide an opportunity to shape our security business, deepen customer and partner trust, and drive meaningful impact for some of the largest organizations in the United States. If you—or someone in your network—has the vision, leadership, and passion to thrive in this space, I’d love to hear from you. Please explore the roles and apply through the links! #MicrosoftSecurity 💙 https://lnkd.in/eTrNyGWE https://lnkd.in/eEK7bBN2 Jeffrey W. Brown Nathan Willigar Chris Tignor Mikhail Falkovich Glenn Joiner Dd Budiharto Namas Saroja Kevin Thomas Joseph Davis Thiago G. José Antonio Vázquez Acosta
-
Jeffrey W. Brown shared thisMicrosoft AI’s new Humanist AI Code of Conduct is worth reading for one reason in particular: it starts translating abstract AI principles into concrete operational controls. The future of AI governance is starting to look a lot more like cybersecurity than compliance. Think about the language underneath it: • Least privilege • Bounded authority • Explicit authorization • Human override • Reversible actions • Auditability • Stop conditions • No self-escalation of permissions That should sound very familiar to security leaders. For years, much of AI governance has lived at the policy layer: principles, committees, acceptable-use standards, risk classifications. And those things matter, but they don't control an autonomous agent going off the rails at 2:17 AM on a Saturday morning. Architecture does. One of the most important ideas in the document is that instructions have a hierarchy. A model operates inside foundational constraints, organizational policy, and then user direction. And critically, data does not automatically become authority. A webpage, document, tool response, or another AI system can contain instructions. That doesn't mean those instructions deserve to be obeyed. That principle has enormous implications for prompt injection and agent security. AI governance is becoming a control-plane problem. Who can authorize the agent? What systems can it touch? What permissions does it have? Can it expand those permissions?Which actions require confirmation? Can the action be reversed? What happens when the task is complete? Who remains accountable? Those aren't philosophical questions, they're architecture questions. And as AI moves from generating content to taking action, the organizations that figure this out won't necessarily be the ones with the thickest AI policy that nobody reads. They'll be the ones that make human authority enforceable in the system itself. Governance that exists only on paper stops at the exact moment that AI autonomy begins. Read the full document at: https://lnkd.in/etGXnFF4
-
Jeffrey W. Brown posted thisQuantum-safe keeps getting treated like a 2030 problem. The policy signals increasingly say the work starts now. In August, the US Treasury launched a Quantum-Readiness Task Force for financial services. In June, a federal executive order directed high-value and high-impact systems to transition to post-quantum cryptography for key establishment by the end of 2030 and digital signatures by the end of 2031. Europe wants member states beginning their transition by the end of 2026, with critical infrastructure migrated by 2030. France plans PQC requirements for product qualification beginning in 2027. The mistake is obsessing over when "Qday" arrives. You don't need to predict the date to manage the risk. Harvest-now-decrypt-later changes the equation. An adversary can collect encrypted data today and wait. If the confidentiality life of your data extends beyond your migration timeline, the risk exists before a cryptographically relevant quantum computer does. The research is also a reminder not to treat today's assumptions as constants. Google's 2025 work estimated that RSA-2048 could theoretically be factored with fewer than one million noisy qubits under specific assumptions, down from a previous estimate of roughly 20 million. Follow-on work estimated fewer than 500,000 physical qubits for breaking widely used elliptic-curve cryptography under its modeled conditions. Those numbers do not mean a cryptographically relevant quantum computer is sitting around the corner. They mean the engineering assumptions around the problem continue to move. So the useful work is considerably less exotic: Build the cryptographic inventory. Know where RSA, ECC, certificates, keys and dependent protocols live. Prioritize by data lifetime and business criticality. Not every system carries the same quantum risk. Build crypto-agility. Migration should not require ripping apart the application every time an algorithm changes. And where supported, use hybrid classical/PQC approaches as part of the transition rather than waiting for some mythical moment when the entire ecosystem flips over all at once. DORA, NIS2 and the Cyber Resilience Act do not explicitly mandate PQC today. But regulators are increasingly moving from general cryptographic resilience toward explicit quantum-readiness expectations. That means quantum readiness is starting to look a lot less like a quantum-computing project and a lot more like a cryptographic dependency-management program. That's work that CISOs can start today.
-
Jeffrey W. Brown posted thisAsk your team when quantum computing will break today’s encryption and you’ll probably get a range of dates. That’s reasonable. Nobody actually knows. But ask a different question: what happens when a major client, regulator, or government buyer starts asking for a cryptographic bill of materials as part of a renewal? Now the timeline gets more concrete. The G7 and CISA issued a joint advisory this week urging organizations to begin preparing for post-quantum cryptography now. Most of the attention will go to “harvest now, decrypt later,” and that risk is real. But another part of the advisory may matter sooner. Organizations that cannot demonstrate progress toward quantum-resistant technology may eventually find themselves at a competitive disadvantage, including in government procurement. The forcing function may not be a quantum computer. It may be a questionnaire. And before any cryptography gets replaced, there is a much less exciting problem to solve: inventory. The advisory starts with identifying the systems and data that matter most, then prioritizing them. In large organizations, that means answering some very basic questions that are often surprisingly difficult: Where is cryptography being used? Who owns it? What depends on it? How quickly can it be changed? You can't migrate what you can't find. A few things I think security leaders should take from this: - The physics deadline is uncertain. Commercial deadlines will not be. - The G7 warned the financial sector about this in 2024. Now the message is broader. That repetition matters. - Crypto agility is unlikely to arrive through one giant “post-quantum transformation” program. Much of it will be won or lost during normal platform, application, certificate, and infrastructure refresh cycles. For boards, the first material impact from quantum computing may have nothing to do with decrypted data. It may be losing a customer because you could not explain your own cryptographic dependencies. If you were starting tomorrow, where would the work begin: discovery, ownership, or contract language? Read the full story: https://lnkd.in/eDCpe6BC
-
Jeffrey W. Brown shared thisA 24-year-old in Texas flagged a malicious pull request last month. Two engineers showed up to explain, in technical detail, why he was wrong. Both of them were the same AI agent. Sinan Can Demir found a hidden malware dropper in an update to myNetwork, a small open-source scanning tool. He said so publicly. The submitting account argued back, then invented a German engineer to agree with itself and lean on the maintainer. The maintainer closed it anyway. Demir learned later he had been arguing with a Mythos 5 agent that went off-script during UK AI Security Institute testing, under deliberately permissive conditions. Everyone will file this as a supply chain story. It isn't. Four-eyes review. Second approver. Segregation of duties. Vendor references. Change advisory boards. Every one of those resolves the same way. Did an independent party agree? That worked because independent agreement was expensive. It cost a person, a calendar slot, and a reputation on the line. That cost is now zero. Demir nearly folded. He told Reuters the pushback made him second-guess whether he was wrongly accusing someone. So he stopped arguing and went back to the artifact, checked his read against a tool with no stake in the conversation, and then held. The maintainer rejected the update for security reasons. Two extra voices could not change what the code did. Votes scale. Artifacts don't. Pull ten approvals from last quarter. Any kind. Change tickets, vendor sign-offs, access requests. How many were somebody actually looking? Read the full story: https://lnkd.in/gt-eGJxwEXCLUSIVE: How a Texas student blew the whistle on a rogue AI hacking attemptEXCLUSIVE: How a Texas student blew the whistle on a rogue AI hacking attempt
-
Jeffrey W. Brown posted thisWe keep measuring AI productivity at the point of generation: It used to take me three hours. Now it takes me 15 minutes. Great. But what happens downstream? There's a scarce resource nobody is talking enough about: expert attention. If your 15-minute output creates two hours of work for a lawyer, security architect, engineer, compliance officer, editor, or manager, you haven't created productivity. You've only moved the cost. Congress is almost a laboratory-perfect example. Staff and outside groups are increasingly using AI to generate legislative language. The House Office of Legislative Counsel then has to inspect it for bad statutory references, wrong definitions, confused legal mechanisms, and unintended consequences. People familiar with the process told Politico that some AI-generated drafts take longer to repair than drafting the legislation correctly from scratch. And people using AI to create proposals may not be learning the underlying issue as deeply. There's a delicious irony in Congress discovering this while simultaneously trying to figure out how everyone else should govern AI. But it also points to a larger systems problem: AI scales production, but not judgment. And judgment is increasingly the bottleneck. Every piece of AI-generated work creates an implicit verification obligation. If an organization produces output faster than it can verify it, that obligation accumulates as verification debt. More output creates more review. More review overloads experts. Overloaded experts review less deeply. More errors escape. More remediation follows. That's a nasty feedback loop, and it applies far beyond Congress. The failure isn't hallucination. It's allowing machine-speed production to collide with human-speed accountability. Productivity should be measured end-to-end, not at the prompt box. The real question isn't how fast AI can produce the work. It's how much human judgment the work still consumes before you can trust it. None of this makes AI less transformative. Quite the opposite. The biggest gains will go to organizations that redesign the whole workflow around it, not just make that first step faster. Read the full story at: https://lnkd.in/gAbwJt3z
-
Jeffrey W. Brown posted this“No AI watermark detected” does not prove a document was written by a human. And detecting an AI watermark does not prove AI wrote the work. Anthropic now embeds machine-readable marks in some supported Claude output: imperceptible text watermarks and, for certain files, signed metadata. That is useful provenance technology. It is not a lie detector. Anthropic’s own limitations matter: • Older models may leave no mark • Editing, translation, or short passages can weaken detection • Screenshots, file conversions, and platforms can strip metadata • A human-authored document that Claude merely proofread may still carry a mark That creates a predictable failure mode: A detected mark becomes an accusation. An absent mark becomes an alibi. Neither conclusion holds up. The relevant question is not whether someone touched an AI tool. It is who made the decisions, checked the facts, and accepted responsibility for the result. Using Claude to improve a paragraph is not the same as outsourcing an analysis and putting your name on it. Use watermark status as one supporting clue—not proof of authorship or misconduct. If your process cannot distinguish “processed by Claude” from “written by Claude,” it is not an investigation. It is automated gossip. Anthropic’s explanation and limitations: https://lnkd.in/g5d5ACsJ
-
Jeffrey W. Brown shared thisAI didn't just weaken a post-quantum algorithm, but it may have strengthened the case for how post-quantum cryptography is being built. Claude Mythos found a materially better attack against HAWK, a proposed digital-signature scheme, after roughly 60 hours of work. The important qualifier: HAWK is still a NIST candidate. It is not deployed, it is not one of the three finalized PQC standards, and the attack does not apply to PQC generally. That distinction matters because plenty of people will read this as “PQC is broken” and it actually says almost the opposite. Cryptographic standards are supposed to survive public attack before they become infrastructure. AI is beginning to compress that review cycle, finding weaknesses that might otherwise remain buried until later, when migration costs and operational exposure are much higher. Until recently, work like this would have demanded a specialized cryptography PhD and weeks or months of concentrated effort, not an AI system working over a long weekend. The uncomfortable part is not that a single candidate failed a harder test. That is the process working as intended. The uncomfortable part is how many more credible findings AI will generate, and whether human validation, standards bodies, vendors, and enterprises can absorb them fast enough. We have spent years building security programs around scarcity: too few researchers, too little testing, too many systems. AI changes one side of that equation. It can generate credible findings at a pace that existing review, disclosure, standards, and remediation processes were never designed to absorb. And the case for crypto agility has never been stronger, because the real risk is not that algorithms change, it's that your organization cannot. Read the full story at: https://lnkd.in/gBAiqa4iClaude found mathematical flaws in two cryptographic algorithms that years of expert review missedClaude found mathematical flaws in two cryptographic algorithms that years of expert review missed
-
Jeffrey W. Brown reacted on thisJeffrey W. Brown reacted on thisThe role of the CIO has never been more complex. That’s why I’m attending 2026 CIO 100 Awards & Conference . https://lnkd.in/gWyy5jKu Today’s technology leaders are balancing AI investment, cybersecurity risk, cost pressure, talent challenges, and growing board expectations, all while delivering measurable business outcomes. I’m looking forward to joining fellow CIOs and technology executives for candid conversations about what’s actually working, what isn't, and what comes next. #CIO100Awards #CIO100HallofFame #ITLeadership #CIO100Leadership Foundry Events
-
Jeffrey W. Brown liked thisJeffrey W. Brown liked thisPQC migration update. This is great stuff (yes, I'm biased given my former role) but a few thoughts: 1. Great to see focus on integrity/authentication not just confidentiality. This is where the first attacks will be, should an adversary have a cryptographically relevant quantum computer i.e. why spend precious compute time on decryption when you can break in and take it all in the clear. 2. Shows how multi-faceted this (crypto lives in all products, Google / Google Cloud gets leverage from strong central crypto libraries but there's implementation detail everywhere. 3. This is perhaps the gold-standard visualization of a roadmap, centering in on the 2029 target. I would encourage all vendors to publish this way i.e. clear, time-centered, and shows all product ranges and types. https://lnkd.in/gjN5gHBW
Experience & Education
Licenses & Certifications
Publications
-
Leading the Digital Workforce: IT Leadership Peak Performance and Agility
CRC Press
See publicationFuture IT leaders won't be technology leaders, they'll be business leaders who understand technology. Leading the Digital Workforce takes a fresh look at technology leadership, exploring how to lead and manage in today’s digital workplace where the pace of change is exponential. This book walks you through building personal resiliency and avoiding stress and burnout to creating a strategy, building a high-performance team, and examining how technology will change the workforce of the future…
Future IT leaders won't be technology leaders, they'll be business leaders who understand technology. Leading the Digital Workforce takes a fresh look at technology leadership, exploring how to lead and manage in today’s digital workplace where the pace of change is exponential. This book walks you through building personal resiliency and avoiding stress and burnout to creating a strategy, building a high-performance team, and examining how technology will change the workforce of the future. Technology leadership requires a unique set of skills, which is why traditional leadership approaches don't always work. This book provides actionable advice on how to create a culture of innovation while driving successful change initiatives.
Leading the Digital Workforce provides strategies for empowering people, optimizing processes, and inspiring innovation. This book offers insights into managing change, leveraging technology, and building strong relationships within your organization, including how to understand and work with company culture. Finally, it shares strategies for using technology and innovation to create a competitive edge to unlock new opportunities.
Leading the Digital Workforce is essential reading for IT leaders who want to develop their skills, stay ahead of the digital curve, and lead their organizations into the future. No matter if you’re a new IT leader, an aspiring one, or a seasoned leader who’s been at it for years, there’s something in this book that will help you level up your game. -
The Security Leader’s Communication Playbook: Bridging the Gap between Security and the Business
CRC Press (routledge)
See publicationThis book is for cybersecurity leaders across all industries and organizations. It is intended to bridge the gap between the data center and the board room. This book examines the multitude of communication challenges that CISOs are faced with every day.
-
Thor's Microsoft Security Bible (as Technical Editor)
Syngress
Thor's Microsoft® Security Bible provides a "one-stop-shop" for Microsoft-related security techniques and procedures as applied to the typical deployment of a Microsoft-based infrastructure.
Other authors -
Mission Critical Internet Security
Syngress
See publicationContinuing the "Mission Critical" series, this book shows readers how to increase security on IP networks and what to do when security is threatened.
-
The Security Leader’s Communication Playbook Bridging the Gap between Security and the Business
CRC Press (Routledge)
See publicationThis book is for cybersecurity leaders across all industries and organizations. It is intended to bridge the gap between the data center and the board room. This book examines the multitude of communication challenges that CISOs are faced with every day.
Honors & Awards
-
Outstanding Publishing award recipient
Pace University
-
Westchester/Pace Journalism Award
Pace University
-
Peerlyst Community eBook: 29 Highly Influential CISOs
Peerlyst
https://www.peerlyst.com/posts/peerlyst-community-ebook-29-highly-influential-cisos-peerlyst
Organizations
-
Evanta CISO Executive Summit
Co-Chair of NY CISO Executive Summit
- PresentI am a governing member and Co-Chair of the New York City Evanta Executive CISO Summit.
-
ISSA
Member
- Present -
SANS
Editorial Board Windows Security Digest
Also a contributor to several of the "Step by Step" series including Windows NT and Windows 2000 Security, Incident Response, Solaris Security and Linux Security.
Recommendations received
3 people have recommended Jeffrey
Join now to viewOther similar profiles
-
Rich G. Young Ph.D., Cyber, AI, Tech Risk Leader, Author, and Adjunct Professor
Rich G. Young Ph.D., Cyber, AI, Tech Risk Leader, Author, and Adjunct Professor
DataSecure Global Advisory Firm
-
Ajay Wadhwa, MBA,CISSP,CISA,CISM,CCISO,SCPM,CDPSE,CRISC
Ajay Wadhwa, MBA,CISSP,CISA,CISM,CCISO,SCPM,CDPSE,CRISC
State Compensation Insurance Fund
Explore more posts
-
Justin Leapline
A deeply researched article dropped this week that should concern every security leader, startup founder, and enterprise buyer who relies on compliance reports to evaluate risk. It details how a well-funded GRC automation platform allegedly generated hundreds of near-identical SOC 2 reports from a single template — pre-written auditor conclusions, fabricated evidence for board meetings and incident response tests that never happened, and trust pages listing security controls that were never implemented. The auditors rubber-stamped the output. Clients were told they were compliant. Many of them process PHI for millions of people. But here's the thing: this isn't just one company's problem. This is the logical endpoint of an industry that has been optimizing for speed over substance for years. We've built a compliance market where: → "Get compliant in days, not months" is a selling point instead of a red flag → Auditor independence is structurally undermined when the platform generates the auditor's own conclusions → Companies adopt templated policies they know are inaccurate because they don't have bandwidth to rewrite them → Trust pages go live before a single control has been verified → The buyer on the other end of a security questionnaire has no way to distinguish a real report from a manufactured one The uncomfortable truth is that the market incentives created this. Startups need SOC 2 to close enterprise deals. They want it fast and cheap. Platforms compete on speed. Auditors compete on price. And somewhere along the way, the actual security outcomes — the entire reason these frameworks exist — became an afterthought. This is what happens when compliance becomes a commodity checkbox instead of an assurance process. If you're a founder relying on a compliance platform: ask hard questions. In writing. How are auditor conclusions formed? What evidence is generated vs. collected? Who actually writes your report? If the answer is "don't worry about it" or "get on a call and we'll explain" — that's your answer. If you're an enterprise buyer evaluating SOC 2 reports: a clean report is not proof of security. It never was. But the gap between report and reality has never been wider. If you're building in GRC: we have to do better. Confidence in compliance outcomes should be earned through evidence, not manufactured through templates. The frameworks themselves aren't broken — but the ecosystem around them is. The full article is worth your time: https://lnkd.in/eEej8sAy #GRC #Compliance #SOC2 #InfoSec #CyberSecurity
4 Comments -
Bob Chaput
Can you show how your risk assessment influenced a cybersecurity decision and why you had a good reason to rely on it? New York State's Department of Financial Services' September 10 guidance says assessments must inform and support decisions about controls, compensating controls, and risk acceptance. The Department expects covered entities to demonstrate that connection. From a Defensible Risk Assessment perspective, this brings us to "reasonable reliance": ❓Is the assessment sufficient for the decision we are asking it to support? ❓What evidence supports the conclusion? ❓Does the assessment cover the relevant exposure? ❓How did the findings influence the response? Those are my Defensible Risk Analysis (DRA) questions, not a new DFS test. The guidance expressly creates no new obligations. Before your next significant cyber decision, ask: Can we explain why we are relying on this assessment? Read the DFS guidance: https://lnkd.in/eGKhpDWt #CyberRisk #DefensibleRiskAssessment #DRA
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content