Lenny Zeltser
@lennyzeltser.com
Builder of security products and programs. Teacher of those who run them. https://zeltser.com
When everyone's attention is on a celebrity vulnerability, you can organize your investigation and share findings using my new template. It's AI-friendly, of course. https://zeltser.com/high-profile-vulnerabilities
Handling High-Profile Vulnerabilities
When a high-profile vulnerability surfaces, executives and customers want to know whether it affects you. With a one-page brief and a short process, you can capture the key details and reach the answer without scrambling.
zeltser.com
Sounil Yu and I mapped security-for-AI products to create the AI Defense Matrix Catalog. Almost half protect runtime AI data, yet over a quarter of the matrix is empty. Products cluster where technology can do the work and thin out where people do. https://zeltser.com/ai-security-market-shape
What 239 Products Reveal About the Shape of AI Security
The security-for-AI market is young and lopsided. Incumbents quickly extended their products into the AI versions of assets they already secured, while the more distinct AI assets drew startups and incumbents alike into markets that stay active and contested.
zeltser.com
Attackers and their malware can turn our trusted tools against us to steal API and SSH keys. In the s1ngularity attack, hijacked AI coding agents combed developer machines for such secrets. Here's how to minimize our exposure. https://zeltser.com/securing-api-keys-on-your-workstation
Securing API Keys on Your Workstation
Every dev tool you grant API access to, AI assistants included, can read the keys within its reach. No setup removes that risk entirely, so the goal is fewer secrets exposed and less damage when one leaks.
zeltser.com
If you help secure AI, whatever your title, Sounil Yu and I have ten quick questions for you. Anonymous, mostly checkboxes. We'll share the analysis, so the more practitioners respond, the more useful the benchmark becomes for everyone. https://zeltser.com/ai-security-survey
Benchmark Your AI Security Decisions: A Five-Minute Survey
Answer ten questions about how your organization secures AI, and you get a peer benchmark in return. Sounil Yu and I will publish findings on which AI assets peers protect, who decides, and where controls come from.
zeltser.com
Third-party keyboards can leak our keystrokes even when the developer isn't malicious. A supply chain attack can hijack a legitimate app, and weak engineering and security practices can expose highly sensitive data. https://zeltser.com/third-party-keyboards-security
Security of Third-Party Keyboard Apps on Mobile Devices
Keyboard apps offer better predictions, voice transcription, and AI-powered writing, all requiring users to send what they type to remote servers. Mobile OS vendors set the rules but can't enforce what developers do with that data.
zeltser.com
I created a short template for capturing and communicating details about a high-profile vulnerability. It helps you share your findings with internal stakeholders and is a starting point for external comms. https://zeltser.com/high-profile-vulnerabilities
Handling High-Profile Vulnerabilities
When a high-profile vulnerability surfaces, executives and customers want to know whether it affects you. With a one-page brief and a short process, you can capture the key details and reach the answer without scrambling.
zeltser.com
Security leaders are making AI security decisions with almost no data about what their peers are doing. Sounil Yu and I built a five-minute anonymous survey to change that, and we'll publish the findings so you can benchmark your approach. https://zeltser.com/ai-security-survey
Benchmark Your AI Security Decisions: A Five-Minute Survey
Answer ten questions about how your organization secures AI, and you get a peer benchmark in return. Sounil Yu and I will publish findings on which AI assets peers protect, who decides, and where controls come from.
zeltser.com
I've seen too many author-centric assessment reports, full of stories of conquest and irrelevant details. The best reports are reader-centered. My new template offers a consistent way to write them that way. It's AI-friendly, too. https://zeltser.com/security-assessment-report-template
A Report Template for Security Assessments
The technical severity of an assessment finding tells only part of the story. A customizable report template helps you document the scope, rate findings by risk, and write for the executives and engineers who read the results differently.
zeltser.com
A decade of CA failures could have collapsed the web's certificate trust model, but they didn't. Browsers and CAs addressed each failure with a structural fix, and the same approach applies wherever you delegate trust. https://zeltser.com/past-present-future-web-trust-model
The Past, Present, and Future of the Web's Trust Model
Observability, short-lived credentials, and active enforcement hold the web's trust model together. Without them, a decade of Certificate Authority failures would've collapsed it. Will those same levers hold for what's coming next?
zeltser.com
Sounil Yu and I built the AI Defense Matrix, an approach for deciding how to defend the various AI systems in your environment. Here's why. https://www.sans.org/blog/why-sounil-yu-i-built-ai-defense-matrix
AI capabilities of keyboard apps (rewrites, voice transcription, generative writing) entice us into letting our keystrokes float to the developer's servers. That makes each one a keylogger we authorized, with safeguards left to the developer. https://zeltser.com/third-party-keyboards-security
Security of Third-Party Keyboard Apps on Mobile Devices
Keyboard apps offer better predictions, voice transcription, and AI-powered writing, all requiring users to send what they type to remote servers. Mobile OS vendors set the rules but can't enforce what developers do with that data.
zeltser.com
My new template for security assessment reports offers a structured, repeatable approach to communicating with readers. It's based on my experience creating and reading many such reports over the years. It's AI-friendly, too. https://zeltser.com/security-assessment-report-template
A Report Template for Security Assessments
The technical severity of an assessment finding tells only part of the story. A customizable report template helps you document the scope, rate findings by risk, and write for the executives and engineers who read the results differently.
zeltser.com
How can you use your AI agent to transform raw threat notes into a well-sourced CTI report draft? Use my MCP server with my new CTI report template and writing guidance. Your sensitive data stays local. https://zeltser.com/cyber-threat-intel-report-template
A Report Template for Cyber Threat Intelligence
Cyber threat intelligence analysts produce credible reports by weighing signals at tactical, operational, and strategic levels. A customizable CTI report template helps analysts capture activity, attribute it with calibrated confidence, and translate findings into defensive actions.
zeltser.com
Observability, short-lived credentials, and active enforcement held the web's certificate trust model through a decade of CA failures. The same three levers work anywhere you delegate trust, from code signing to identity federation. https://zeltser.com/past-present-future-web-trust-model
The Past, Present, and Future of the Web's Trust Model
Observability, short-lived credentials, and active enforcement hold the web's trust model together. Without them, a decade of Certificate Authority failures would've collapsed it. Will those same levers hold for what's coming next?
zeltser.com
My new template for cyber threat intelligence reports covers tactical, operational, and strategic aspects of threat activity. A companion brief captures the key takeaways for decision-makers. You can also use it with your AI agent. https://zeltser.com/cyber-threat-intel-report-template
A Report Template for Cyber Threat Intelligence
Cyber threat intelligence analysts produce credible reports by weighing signals at tactical, operational, and strategic levels. A customizable CTI report template helps analysts capture activity, attribute it with calibrated confidence, and translate findings into defensive actions.
zeltser.com
Threat attribution works at 3 levels: Tactical examines the incident, operational characterizes the campaign, and strategic asks who's responsible and why. Disciplined analysts weigh the same 6 signals at every level. https://zeltser.com/six-signals-for-threat-attribution
Six Signals for Threat Attribution
Credible threat attribution weighs six signals together. Each signal has a disciplined methodology behind it, with citations and stress tests to back the conclusions.
zeltser.com
Every domain has its Turbo Encabulator. The more expert we feel, the more fluently we explain something that doesn't exist. https://zeltser.com/experts-overstate-expertise
Experts Cannot Help Overstating Their Expertise
The more confident we feel in a domain, the more likely we are to claim knowledge that doesn't exist. Recognizing this overclaiming bias helps us invite critique when we share our expertise and ask sharper questions when others share theirs.
zeltser.com
This template for a security incident report not only helps with documentation, but also offers guidance when capturing findings during the incident. Take it, customize it, use it. https://zeltser.com/incident-response-report-template
A Report Template for Cybersecurity and Privacy Incident Response
Incident responders need to know which questions to ask and how to communicate the answers to a diverse set of stakeholders. A customizable report template gives the response coordinator that structure when the stakes are high.
zeltser.com
Plant a decoy persona, such as a fake LinkedIn profile or an unused directory account, to catch attackers reaching for what they think is real. The decoy has no production use, so any interaction is a high-confidence alert. https://zeltser.com/the-notion-of-a-honeypot-persona
Plant Decoy Personas to Detect Impersonation Attacks
Decoy personas extend honeytoken thinking to user accounts and public profiles. The technique gives defenders a tripwire on the identity surface that other detection layers don't cover.
zeltser.com
We read more threat attribution claims than we make. Six signals separate the ones that hold up from the ones that don't, and analysts weigh them together to build a defensible case. https://zeltser.com/six-signals-for-threat-attribution
Six Signals for Threat Attribution
Credible threat attribution weighs six signals together. Each signal has a disciplined methodology behind it, with citations and stress tests to back the conclusions.
zeltser.com
Letter grades tied to specific criteria influence business' behaviors, as NYC's sanitation labels have shown. Cybersecurity is starting to follow with the Cyber Trust Mark for IoT, but the consumer web hasn't caught up. https://zeltser.com/restaurant-inspections-as-security-validation-model
What Cybersecurity Can Learn from NYC Restaurant Inspections
When letter grades are visible at the moment of decision, businesses improve their practices, with NYC restaurants raising their sanitation scores 35% within three years. The U.S. Cyber Trust Mark is starting to bring the model to consumer IoT, while consumers still don't see equivalents on the webs
zeltser.com
A decoy persona alerts you when an attacker probes your directory or public profiles. When they can't tell the bait from real identities, you create an asymmetry that gives you the upper hand. https://zeltser.com/the-notion-of-a-honeypot-persona
Plant Decoy Personas to Detect Impersonation Attacks
Decoy personas extend honeytoken thinking to user accounts and public profiles. The technique gives defenders a tripwire on the identity surface that other detection layers don't cover.
zeltser.com
"The career-shaping work happens in the years before the job search." 100% We're seeing others say the same things albeit in other areas, such as leadership
The career-shaping work happens in the years before the job search. Reputation, relationships, and visible work are what land the right role. The resume's job ends at initial screening. https://zeltser.com/stop-relying-on-your-resume
Stop Relying on Your Resume
A resume gets you past initial screening. Reputation, relationships, and visible work built in the years before the search are what land the right role.
zeltser.com
Having interviewed many candidates, I can tell within minutes whether someone prepared for the discussion. A few hours of focused prep often makes the difference between getting the offer and getting a polite no. https://zeltser.com/interviewing-tips-for-it-job-candidates
5 Interviewing Tips for Tech and Cybersecurity Jobs
Strong technical skills get you to the interview, but preparation gets you the offer. Show up having done the homework that many candidates skip.
zeltser.com
The REMnux MCP server can now draft malware analysis reports using my new report template: https://zeltser.com/ai-malware-analysis-remnux
Using AI Agents to Analyze Malware on REMnux
To analyze malware effectively, AI agents need practitioners' expertise and access to the analysis tools. The REMnux MCP server provides both, connecting AI to 200+ tools on REMnux with guidance on which to run and how to interpret their output.
zeltser.com
Self-hosted Algo on DigitalOcean lets us treat the VPN exit IP as disposable. After investigating malicious infrastructure, destroy the droplet, redeploy in minutes, and the next project starts from a clean IP. https://zeltser.com/deploy-algo-vpn-digital-ocean
How to Deploy Your Own Algo VPN Server in the DigitalOcean Cloud
Tunneling connections through a VPN in a public cloud helps conceal your origin and safeguard traffic when performing security research or connecting over untrusted networks. Algo VPN is an open-source bundle designed for self-hosted VPN services that's easy to deploy on DigitalOcean and relies only
zeltser.com
I updated my cheat sheet for creating cybersecurity assessment reports. It's a one-page doc, which you can customize: https://zeltser.com/security-assessment-report-cheat-sheet
Tips for Creating a Strong Cybersecurity Assessment Report
In a strong cybersecurity assessment report, you rate each finding by its risk to the organization rather than its raw tool score. You give readers the context and remediation steps they need to act on it. This cheat sheet covers how to analyze the data, document scope and methodology, write up find
zeltser.com
The people who handle breaches all day may be the worst at protecting themselves. Feeling invulnerable is what lets us function around constant threat, the way it lets doctors work around disease. Warnings about our own risk rarely stick. https://zeltser.com/illusion-of-invulnerability
The Illusion of Invulnerability in Cybersecurity
Healthcare workers wash hands more often when signs emphasize protecting patients rather than themselves, because people overestimate their own invulnerability but not others'. Security messaging may be more effective when highlighting risks to customers or colleagues rather than to the individuals
zeltser.com
A decoy fires only when someone accesses a resource no legitimate user would touch. Plant tripwires across network, identity, data, and AI agent configs to create asymmetry in your security architecture. https://zeltser.com/protean-information-security-architecture
Building Deception Into Your Security Architecture
Decoys add strategic asymmetry to your security architecture, strengthening your advantage against the attacker. Plant tripwires across network, identity, data, and AI agent configs for high fidelity alerts.
zeltser.com