Julio J.

Misinformation is circulating that Microsoft has stopped accepting SOC 2 reports for its SSPA program. This is incorrect. The April 2025 SSPA program guide states “A SOC 2 report may be accepted for DPR Section J (security) where no qualifications are noted." However, it is correct that SSPA may require SaaS companies to obtain an ISO 27001 and/or an ISO 42001 certification depending on a SaaS company’s agreement with Microsoft. They do not require SaaS companies to obtain an Unqualified SOC 2 report in any circumstances. But this doesn’t mean that Microsoft’s SSPA program won’t accept SOC 2 as evidence of meeting security requirements. An unqualified SOC 2 report is still a valid and valuable way to demonstrate your security posture to Microsoft and other customers. Don't let these rumors diminish the credibility of SOC 2 reports.

59

7 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

The latest DISA Cloud Computing Security Requirements Guide just dropped... This was an out of cycle release which means the update is very important. In this release the topic of "digital escorts" is addressed. If you're not familiar with the "digital escorts" concerns, check out the links in the comments. This update is pretty spicy as it illuminates what's happening behind the scenes and in the news. I'm happy to see DISA address this so quickly. #Security #NationalSecurity #DISA

45

13 Comments

David Worthington reminds us that the focus of the ICS company is Safety, and Producing Your Product, not cyber security.   Cyber security is only useful as it supports those.  SANS ICS Summit SANS Institute

66

5 Comments

Just published a full step-by-step walkthrough on Rooting the Butler machine (TCM Security). This write-up covers the complete attack path — from initial enumeration to privilege escalation. If you’re preparing for hands-on certifications or sharpening real-world pentesting skills, this one’s for you.

15

1 Comment

The backlog continues to grow, with "Undergoing Analysis" breaking 10k now. This total backlog is more vulns than total disclosures for most prior years. CVE getting last minute funding from CISA makes zero difference if there is no CPE, CVSS, etc. that assists teams in triage and programmatically addressing patches.

44

5 Comments

Apple's ballot to step the maximum term for public SSL certificates down to 47 days has passed in the CA/Browser Forum. Jason Soroko and I explain on the Root Causes Podcast. Audio: https://lnkd.in/g8wintC4 Video: https://lnkd.in/gmQjHhp8

53

A hill I will always die on... Intrusion detection tools that don't expose their detection logic with alerts are a sure sign that product management is out of touch or has misaligned priorities with SOC goals. The product's goal is to help analysts perform their job effectively. And no, vendors, the detection signature isn't your market differentiator. That should be, among other things, your ability to create and maintain high-quality detection signatures quickly. #ThreatIntel #SOC #DFIR

241

14 Comments

CISA warns of state-backed attacks on Signal, WhatsApp, Telegram users... Although end-to-end encryption can secure messages on their journey between two devices, and prevents snooping by anyone intercepting your communications, it doesn't prevent anyone who has access to the device itself from reading your messages. Read more in my article on the Bitdefender blog: https://lnkd.in/eteG-tF4 #cybersecurity #privacy

134

23 Comments

Update on our Box MCP + Burp SSL/TLS blocker: Burp Support confirmed they're on it! We reported that Burp's CA certs were missing fields required by Python 3.13's VERIFY_X509_STRICT flag, preventing traffic capture in Burp. Great news: Burp's team has added this to their roadmap as a feature request and are working on an update 🚀 This means cleaner MCP pentesting workflows are coming - no more runtime workarounds just to capture HTTPS traffic. Small wins like this strengthen our security tooling. Props to Burp for being responsive 🎉 Have you faced certificate validation errors in Burp's workflow lately? Would love to hear your stories! #mcpsecurity #burpsuite #appsec #aisecurity #appsecco

81