AI Governance, new book (Code War) from Allie Mellen, and the weekly news! – Jeremy Snyder, Allie Mellen – ESW #450

Adrian Sanabria

1. FUNDING/M&A, courtesy of the Security, Funded newsletter, #234 – The Signal is Loading

   VIBE CHECK

   Given all of the AppSec excitement last week, where is the next likely place that frontier AI labs will attack the security stack?

   • 40% - Threat intelligence
   • 27% - Compliance / GRC
   • 20% - Cloud security
   • 13% - Identity management/governance
   • 0% - Risk dashboards/exec reporting
   • 0% - Other

   FUNDING

   • AI DLP company, Jazz, raises 61M
   • Cylake, a United States-based AI-driven security operations platform for companies that require offline or data sovereignty options, raised a $45.0M Seed from Greylock.
   • JetStream Security, a United States-based AI governance and security platform, raised a $34.0M Seed from Redpoint.
   • Fig Security, an Israel-based data engineering management platform for security log data, raised a $30.0M Series A from Team8 and Ten Eleven Ventures.
   • Reclaim Security, a United States-based threat and risk prioritization platform, raised a $20.0M Series A from Acrew Capital and a $6.0M Seed.
   • Circadence, a United States-based cyber range platform for hands-on simulations for security professionals to defend against attack scenarios, raised a $16.4M Private Equity Round from Seneca Partners.
   • ArmorCode, a United States-based application security posture management (ASPM) platform, raised a $16.0M Venture Round from Cheyenne Ventures.
   • IntelliGRC, a United States-based security and compliance automation platform focused on the CMMC compliance framework, raised a $3.5M Seed from Kyle Hanslovan, Blu Ventures Investors.
2. NEW COMPANIES: Root Evidence Launches Evidence Scan Enterprise Preview
3. NEW FEATURES: Introducing the Crowdstrike API Key Canarytoken
4. FREE TOOLS: The Signal — Cybersecurity Market Intelligence

   A new free tool from Mike Privette

5. FREE TOOLS: GitHub – xaitax/TotalRecall

   "This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots."

6. NEW TOOLS: googleworkspace/cli: Google Workspace CLI

   One command-line tool for Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, and more. Dynamically built from Google Discovery Service. Includes AI agent skills.

7. VULN MGMT: Zero Day Clock
8. FREE TOOLS: GitHub – ruvnet/wifi-densepose

   WiFi DensePose turns commodity WiFi signals into real-time human pose estimation, vital sign monitoring, and presence detection — all without a single pixel of video.

9. ESSAYS: Caleb Sima on LI: “We just deployed more attack surface in 12 months than we built in the previous decade”
10. ESSAYS: What security categories will stay relevant

    With AI lowering the bar for more complex software development and developer team size, Frank Wang discusses what, if any, market impact we should expect to see.

11. ESSAYS: from Ryan McGeehan – LinkedIn discussion on quantifying cyber risk.
12. ESSAYS: AI can’t replace jobs
13. ESSAYS: Reevaluating vulnerability management
14. REPORTS: CrowdStrike says attackers are moving through networks in under 30 minutes

    TL;DR - we have even less time to respond to incidents

15. REPORTS: Google warns hackers are targeting third parties and software flaws

    Direct link to report: https://services.google.com/fh/files/misc/cloudthreathorizonsreporth12026.pdf

16. BREACH ANALYSIS: Apache ActiveMQ Exploit Leads to LockBit Ransomware – The DFIR Report
17. BREACHES: Stryker cyberattack: Alleged Iran-linked group Handala causes outage

    Wipers are super nasty - hard to tell how bad this is at this point. Might take a while for full details to come out. Here's a list of stuff from both news stories and Kevin Beaumont. No idea how accurate these details are, so take with a grain of salt.

    • Wiped systems, pushed OS updates to personal phones connected to MDM
    • Used the MDM (InTune) to send wipe signals, reportedly no malware used
    • Datacenters inaccessible
    • they (Handala) used admin accounts to do the damage and left defacements on login pages
    • sent emails to execs, taking ownership for the hack
    • theory that Stryker was a target because it was a US/Israeli defense contractor & seen as a possible path to defense stuff/soldiers, could be looking for data with military value also
    • claimed responsibility to Kevin Beaumont, saying they hit 250M endpoints & that this was retaliation for the girls' school that got wiped out
    • this group's MO is to leverage administrative tools and lay low inside victim networks for long periods of time
18. LEGISLATION: The long-awaited Trump cyber strategy has arrived

    As promised, it's short, and nearly identical to what we discussed in a topic segment a few episodes ago, save some wording changes.

19. WATCH: The Internet Was Weeks Away From Disaster and No One Knew

    An EXCELLENT documentary on the XZ Utils incident by prominent YouTube channel Veritasium.

20. DUMPSTER FIRES: From Attrition on LI: Over 30k CVEs waiting on NVD enrichment now

    "As we await word of CVE being funded or if anything will change there, I can't help but notice the NVD backlog broke 30,000. Almost two years ago we were assured by them that the backlog would be… "

21. SQUIRREL: Spectre I – Audio Privacy Device

    I have doubts, but I'm not willing to pay $1200 to say "I told you so"

Ayman Elsawah

1. Security Cafe: AI + Security (Part I)

   Ayman Elsawah gives a rant on AI + Security and who (or what) is actually responsible for the code when things go awry

2. Ayman’s BSidesSF Talk

Dustin Sachs

1. Stryker Cyber Attack: Iranian Threat Actor Claims Revenge