"Beyond the Vulnerability Apocalypse: Scaling Your Basics and Vulnerability Management" medium.com/anton-on-sec... <- a bit high level, sure, but hopefully useful for our bosses and their bosses :-)
Beyond the Vulnerability Apocalypse: Scaling Your Basics and Vulnerability Management
Developed together with Usman Chaudhary @ Google for Public Sector (his post)
medium.com
'“AI Normal Tech” vs “AGI by Tuesday”: Security Advice That Survives Either Future' medium.com/anton-on-sec... <- kinda mostly humorous, but also probably useful. Warning: parrots!
“AI Normal Tech” vs “AGI by Tuesday”: Security Advice That Survives Either Future
If you look at social media debates about AI, two extreme patterns emerge. Studying extreme patterns is very useful because understanding…
medium.com
"From Cloud to Chaos: Defining Shared Responsibility for AI Security" medium.com/anton-on-sec... <- jokes and painful questions (and some answers) from CoSAI work on AI shared responsivity
From Cloud to Chaos: Defining Shared Responsibility for AI Security
For 15 years (!), many of us who have touched cloud security have struggled with the shared responsibility model for cloud security. As…
medium.com
"Anton’s Security Blog Quarterly Q2 2026" medium.com/anton-on-sec... <- best / recent of my fun blogs, podcasts, etc. Enjoy!
Anton’s Security Blog Quarterly Q2 2026
My Anton’s Security Blog Quarterly covers both Anton on Security and my posts from Google Cloud blog, Google Cloud community blog, and our…
medium.com
"Stop Building a 2003 #SOC with AI: A Modern People & Process Framework (Part 1)" medium.com/anton-on-sec... <- a new fun exploration of "legacy process + new tools = hilarity" in your SOC!
Stop Building a 2003 SOC with AI: A Modern People & Process Framework (Part 1)
One particular aspect of an agentic or AI-powered SOC (but NOT “humanless SOC”) has bothered me over the last few months: specifically, the…
medium.com
Most organizations: from the DoD, to Fortune 100, to startups have had increasing unresolved vulnerability counts for decades
Anton Chuvakin@anton1chuvakin.bsky.social · 4mo ago"Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So?" medium.com/anton-on-sec... <- a "warm" take on vuln mgt in 2026.
"Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So?" medium.com/anton-on-sec... <- a "warm" take on vuln mgt in 2026.
Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit…
Many years ago while at Gartner, I wrote a blog post where I defined the concept of the “Patch Sound Barrier.” (original via Archive if you…
medium.com
"Still Using That Legacy SIEM? It’s Time for a 2026 Reality Check" has some of my time-tested SIEM migration tips evolved to today (Warning: nothing Earth-shattering there) security.googlecloudcommunity.com/community-bl...
Still Using That Legacy SIEM? It’s Time for a 2026 Reality Check | Community
Author: Anton Chuvakin, Office of the CISO I’ve been banging the drum about SIEM migration for a long time. If you’ve followed my work since the Gartner days (or even the "Security Warrior" era), you…
security.googlecloudcommunity.com
"Breaking the Patch Sound Barrier Part 2: So Is The Apocalypse Coming and What Is It?" medium.com/anton-on-sec... <- the patching speed saga continues :-)
Breaking the Patch Sound Barrier Part 2: So Is The Apocalypse Coming and What Is It?
So, you read my previous blog post about breaking the patch sound barrier, but it left you wanting more? Well, this is that “more.”
medium.com
"Risk Tiering AI Use Cases - A Practical Guide" security.googlecloudcommunity.com/community-bl... <- a new blog from our team, high-level but very useful if you are struggling with "ban vs FOMO" with AI
Risk Tiering AI Use Case - A Practical Guide | Community
Authors:Marina Kaganovich, Office of the CISO.Anton Chuvakin, Office of the CISO Introduction“AI governance” is a term that is often too narrowly focused on the technological shift genAI has spurred.…
security.googlecloudcommunity.com
"Still Using That Legacy SIEM? It’s Time for a 2026 Reality Check" has some of my time-tested SIEM migration tips evolved to today (Warning: nothing Earth-shattering there) security.googlecloudcommunity.com/community-bl...
Still Using That Legacy SIEM? It’s Time for a 2026 Reality Check | Community
Author: Anton Chuvakin, Office of the CISO I’ve been banging the drum about SIEM migration for a long time. If you’ve followed my work since the Gartner days (or even the "Security Warrior" era), you…
security.googlecloudcommunity.com
"Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So?" medium.com/anton-on-sec... <- a "warm" take on vuln mgt in 2026.
Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit…
Many years ago while at Gartner, I wrote a blog post where I defined the concept of the “Patch Sound Barrier.” (original via Archive if you…
medium.com
"RSA 2026: Agentic Future, Analog Fundamentals — The Paradox of Why the Old Guard Still Survives" medium.com/anton-on-sec... <- the classic! My annual #RSAC #RSA2026 reflection post!
RSA 2026: Agentic Future, Analog Fundamentals — The Paradox of Why the Old Guard Still Survives
OK, RSA 2026 is over. If my record keeping is correct, I first attended RSA in 2006. At that time, I was annoyed by … AI? XDR? NIDS? ……
medium.com
AI SOC vendors are selling a future that production deployments haven’t reached yet 📖 Read more: www.helpnetsecurity.com/2026/03/26/f... #cybersecurity #cybersecuritynews #agenticAI #SOC #automation #securityoperations @anton1chuvakin.bsky.social @cyberfuturists.com @aunooai.bsky.social
AI SOC vendors are selling a future that production deployments haven't reached yet - Help Net Security
AI SOC vendor claims don't match what practitioners see in production. A report documents the gap between marketing and incident performance.
helpnetsecurity.com
"These 4 AI governance tips help counter shadow agents" cloud.google.com/transform/th... <- high level admittedly, but fun! See you at #RSAC #RSA2026
These 4 AI governance tips help counter shadow agents | Google Cloud Blog
It’s not easy to stop employees from using shadow agents, but these 4 tips on robust AI governance can make the shadows less appealing.
cloud.google.com
"Anton’s Vibe Coding Experience: A Reflection on Risk Decisions" medium.com/anton-on-sec... <- security musings I got while vibe coding an app; read for entertainment, this is NOT security advice :-)
Anton’s Vibe Coding Experience: A Reflection on Risk Decisions
Look, I’m not a developer, and the last time I truly “wrote code” was probably a good number of years ago (and it was probably Perl so you…
medium.com
"Community Contest: Create and Share Your Security Gemini Gems" security.googlecloudcommunity.com/news-announc... <- share your security-focused Gemini Gems, win prizes!
Community Contest: Create and Share Your Security Gemini Gems | Community
Create and Share Your Security Gemini Gems We're launching a new Community challenge, and this time you not only have a chance to win Google swag, but to also be featured on the Google Cloud Security…
security.googlecloudcommunity.com
"Google Cloud Security Threat Horizons Report #13 (H1 2026) Is Out!" medium.com/anton-on-sec... <- read my fun highlights , then read the entire report?
Google Cloud Security Threat Horizons Report #13 (H1 2026) Is Out!
This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our next Cloud…
medium.com
"My Really Fun RSA 2026 Presentations!" #RSAC #RSA2026 medium.com/anton-on-sec... <- shadow agents, AI SOC, Google security lessons (and AI), very fun!
My Really Fun RSA 2026 Presentations!
This blog is perhaps a little bit more like an ad, so if you don’t want to check the ads, consider not reading it.
medium.com
Check out Episode 257 of the Google Cloud Security Podcast: "Beyond the 'Kaboom': What Actually Breaks When OT Meets the Cloud?" hosted by @anton1chuvakin.bsky.social and Tim Peacock and featuring yours truly. cloud.withgoogle.com/cloudsecurit... Or youtu.be/XJqWbpKHLDs?...
"Beyond “Is Your #SOC #AI Ready?” Plan the Journey!" medium.com/anton-on-sec... <- a long promised Part 2 for preparing your SOC for the arrive of AI capabilities.
"Beyond “Is Your #SOC #AI Ready?” Plan the Journey!" medium.com/anton-on-sec... <- a long promised Part 2 for preparing your SOC for the arrive of AI capabilities.
"Office of the CISO 2025 Year in Review: 3 Key AI Security & Governance Themes" security.googlecloudcommunity.com/ciso-blog-77... <- our team (Office of the CISO at Google Cloud) recap of 2025 AI security discussions and writing
Office of the CISO 2025 Year in Review: 3 Key AI Security & Governance Themes | Community
Co-Author: Anton ChuvakinSimilar to our 2024 AI blog recap, as we reflected on the customer conversations we had in 2025 and the blogs we’ve written, 3 key themes emerged. The common thread woven…
security.googlecloudcommunity.com
"Office of the CISO 2025 Year in Review: 3 Key AI Security & Governance Themes" security.googlecloudcommunity.com/ciso-blog-77... <- our team (Office of the CISO at Google Cloud) recap of 2025 AI security discussions and writing
Office of the CISO 2025 Year in Review: 3 Key AI Security & Governance Themes | Community
Co-Author: Anton ChuvakinSimilar to our 2024 AI blog recap, as we reflected on the customer conversations we had in 2025 and the blogs we’ve written, 3 key themes emerged. The common thread woven…
security.googlecloudcommunity.com
"2025 Year in Review at Cloud Security Podcast by Google" medium.com/anton-on-sec... <- Tim and me reflect on our favorite podcast episodes this year!
2025 Year in Review at Cloud Security Podcast by Google
(written jointly with Tim Peacock)
medium.com
"Anton’s Security Blog Quarterly Q4 2025" medium.com/anton-on-sec... <- my usual "quarterly-ish" summary of recent and popular blogs, podcasts and other materials. Enjoy!
Anton’s Security Blog Quarterly Q4 2025
Amazingly, Medium has fixed the stats so my blog / podcast quarterly is back to life. As before, this covers both Anton on Security and my…
medium.com
"2025 Year in Review at Cloud Security Podcast by Google" medium.com/anton-on-sec... <- Tim and me reflect on our favorite podcast episodes this year!
2025 Year in Review at Cloud Security Podcast by Google
(written jointly with Tim Peacock)
medium.com
"Anton’s Security Blog Quarterly Q4 2025" medium.com/anton-on-sec... <- my usual "quarterly-ish" summary of recent and popular blogs, podcasts and other materials. Enjoy!
Anton’s Security Blog Quarterly Q4 2025
Amazingly, Medium has fixed the stats so my blog / podcast quarterly is back to life. As before, this covers both Anton on Security and my…
medium.com
EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance cloud.withgoogle.com/cloudsecurit... <- the last podcast of 2025 we just aired. See you in 2026!
EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance
The Cloud Security Podcast from Google is a weekly news and interview show with insights from the cloud security community.
cloud.withgoogle.com
"Implementing Secure AI Framework (#SAIF) Controls in Google Cloud" security.googlecloudcommunity.com/ciso-blog-77... <- this blog launches a new paper on SAIF #AI controls in Google Cloud. More useful than fun, admittedly :-)
