I write about the things that keep executives up at night — and the things they should be losing sleep over but aren’t.

Over the past few months I’ve published deep dives on the collisions between AI, cybersecurity, leadership, and the forces reshaping the workforce. Here are 10 you might find useful:

🔒 Security & Leadership
→ Nearly 25% of Fortune 500 CISOs last just one year. The problem isn’t the people — it’s the system.
https://kiledjian.com/2025/10/14/built-to-fail-the-structural.html
→ Attackers aren’t deploying AI someday. They’re doing it now — and 80% of recent ransomware already uses it.
https://kiledjian.com/2025/10/05/cybersecurity-in-the-era-of.html
→ A new anonymous wireless carrier claims to know nothing about its customers. I did a technical teardown.
https://kiledjian.com/2025/12/17/in-the-final-weeks-of.html
→ “Unhackable” phones are everywhere on social media. Here’s what a security professional actually thinks.
https://kiledjian.com/2026/01/25/why-there-is-no-such.html

🤖 AI — Practically
→ The “stochastic parrot” era is over. What that means for your boardroom.
https://kiledjian.com/2026/01/24/the-end-of-the-stochastic.html
→ Your AI agrees with you too much. Here’s how to fix that with better prompts.
https://kiledjian.com/2025/10/07/prompting-strategies-to-reduce-ai.html
→ One line added to any prompt can improve AI output by 14–45%. No tools required.
https://kiledjian.com/2025/11/28/improving-ai-outcomes-through-better.html

🌍 The Bigger Picture
→ In 2026, the internet is a contested information environment. Here’s a field manual for protecting your perception.
https://kiledjian.com/2026/01/19/contested-information-environment-a-field.html
→ France just recorded more deaths than births for the first time since WWII. The U.S. is projected to follow by 2030. What this means for business.
https://kiledjian.com/2026/01/29/the-demographic-crossroads-understanding-natural.html
→ The Great Resignation is dead. Welcome to “job clinging” — and it’s worse than you think.
https://kiledjian.com/2025/09/29/the-great-resignation-is-over.html

I write at kiledjian.com — no ads, no sponsors, no vendor spin. Just analysis from 25+ years in cybersecurity and technology leadership.

#Cybersecurity #AI #Leadership #CISO #ArtificialIntelligence #PromptEngineering #Privacy #InfoSec #ThreatIntelligence #FutureOfWork #ExecutiveLeadership #TechLeadership #AgenticAI #CyberRisk #DigitalTransformation​​​​​​​​​​​​​​​​

AI-powered threats, geopolitical risk shifts & resilience strategies—decoded in our 2026 Cybersecurity Report.
Get your copy: https://zurl.co/A8lDK

#Cybersecurity #CISO #AI #Infosec

Global Incident Response Report 2026 - Key Observations:
• Identity present in ~90% of investigations
• 87% of intrusions spanned multiple attack surfaces
• 48% involved browser-based activity
• Fastest exfiltration window reduced to ~72 minutes
• Encryption declining, data theft remains primary leverage

Operational implications:
– Consolidated telemetry is mandatory
– Phishing-resistant MFA should be prioritized
– Machine identity governance requires urgent maturity
– SaaS integration mapping must become continuous

Source: https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report

Question for practitioners:
Where is your greatest visibility gap today - identity, SaaS, cloud, or browser?

Follow @technadu for structured IR intelligence and emerging threat analysis.

#IncidentResponse #ThreatDetection #SOC #IdentitySecurity #SaaSRisk #SupplyChainSecurity #CyberDefense #ThreatHunting #CISO

🛡️ 𝗧𝗼𝗱𝗮𝘆'𝘀 𝗥𝗲𝘃𝗶𝗲𝘄! 🧱

This week, our #CyberCanon Committee provides you with Debra Baker's 𝘼 𝘾𝙄𝙎𝙊 𝙂𝙪𝙞𝙙𝙚 𝙩𝙤 𝘾𝙮𝙗𝙚𝙧 𝙍𝙚𝙨𝙞𝙡𝙞𝙚𝙣𝙘𝙚.

Read Jack Freund, Ph.D.'s assessment 👉 https://cybercanon.org/a-ciso-guide-to-cyber-resilience/

#CybersecurityBooks #CISO #CyberResilience

This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now

997 words, 5 minutes read time.

If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.

This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.

What this scam actually is

You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.

It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:

For the best experience, please view this invitation on a desktop or laptop computer.

If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.

And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.

Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.

Why this is an absolute nightmare for security teams

Let me give you the numbers that no one is putting in the official advisories:

• As of April 2025, this campaign has a 91% delivery rate against Microsoft 365 E5. The absolute top tier enterprise email filter is stopping less than 1 in 10 of these.
• Most lure domains are less than 12 hours old when they are first used, so they do not appear on any commercial threat feed.
• This is not just targeting consumers. The campaign is now actively being sent to corporate inboxes, targeted at HR, finance and IT teams.
• Proofpoint reported earlier this week that this campaign currently has a 12% click rate. For context, the average phish has a click rate of 0.8%.

I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.

This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.

How to not get burned

I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.

For everyone

• Real Punchbowl invites will only ever come from an address ending in @punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.
• Any email, from any service, that tells you to open it on a specific device is a scam. Full stop. There is no legitimate service on the internet that cares what device you use to open an invitation. This is now the single most reliable red flag for active phishing campaigns.
• Do not go to Punchbowl’s website to “check if the invite is real”. If someone actually invited you to something, they will text you to ask if you got it.

For SOC Analysts and Security Teams

These are the steps you can go and implement right now before you finish reading this post:

Closing Thought

The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.

If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• Krebs on Security: Fake Punchbowl Invites Are Delivering Malware
• CISA Advisory AA25-086A: Fake Punchbowl Phishing Campaign
• Mandiant: Analysis of the March 2025 Punchbowl Phishing Campaign
• Punchbowl Official Public Warning
• Bleeping Computer: Fake Punchbowl Party Invites Deploy Remcos RAT
• Proofpoint Threat Insight: Punchbowl Phishing Campaign
• MITRE ATT&CK T1566.001: Spearphishing Link
• Verizon DBIR 2025: Phishing Effectiveness

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Уровень зрелости ИБ (простыми словами о важном)

TL;DR: Вы покупаете дорогие security-решения, но при инциденте всё равно паника и хаос? Проблема не в инструментах, а в том, что делаете не на своём уровне зрелости. Разбираем 6 уровней развития ИБ — от «всё на общих паролях» до «безопасность как конкурентное преимущество». Типичная история: компания тратит на ИБ миллионы, покупает модные SIEM/DLP/EDR, нанимает специалистов, проводит аудиты. А потом прилетает шифровальщик — и выясняется, что бэкапы лежат на том же сервере, доступы раздавали «как у Васи, чтобы не бегать», а план реагирования существует только на бумаге. Проблема одна: делаете не на своём уровне зрелости. Зрелость ИБ — это не про стандарты ISO и не про сертификаты SOC2. Это способность не развалиться от типовых проблем и при этом не убить бизнес параноидальным контролем. Это баланс между «нас точно взломают» и «давайте проверять каждый клик сотрудника». Что внутри статьи: 5 уровней зрелости — от уровня 0 («пароли в общем чате», этот уровень вообще не считаем за уровень) до уровня 5 («ИБ как фактор выигрыша тендеров») Портреты компаний на каждом уровне — узнаете себя в первом абзаце Типичные факапы и почему они происходят именно на вашей стадии Инструменты и процессы — какие имеют смысл на каждом этапе Никаких переводов западных фреймворков. Только то, что работает в наших реалиях. Главный месседж: нормально быть на уровне 2-3, если вы там стабильны и честны с собой. Гораздо хуже притворяться зрелыми на бумаге и гореть на практике. Модель зрелости — это не экзамен на оценку. Под катом — разбор уровней с примерами, рисками и конкретными действиями. Если хоть раз ловили себя на мысли «мы вроде что-то делаем, но непонятно, достаточно ли этого» — welcome.

https://habr.com/ru/articles/1000308/

#ciso #vciso #cio #information_security #information_systems_audit #audit #информационная_безопасность #иб #зрелость #зрелость_в_it