One thing SAF does well is to help you connect business priorities to architecture, controls, processes, operations (as well as Microsoft implementation guidance). We many programs struggle with this. See aka.ms/SAF (no paywall, no registration)
Mark Simos
@markasimos.bsky.social
Lead Cybersecurity Architect • Executive and Board Advisor • Keynote Speaker • Professional Storyteller https://www.youtube.com/@MarkonCybersecurity
Controlling access requires a subject, verb, and object (regardless of whether it involves humans, AI agents, data, deterministic systems, or physical objects) - Who or what is requesting access? - What action are they taking? - What business asset are they touching?
The “keeping secrets from family” antipattern in SAF captures a common failure: incident learnings stay trapped inside SecOps a short 🧵
Trying to communicate security & risk better with business colleagues? Microsoft published tips, learnings, and best practices as part of the new Security Adoption Framework (SAF) guidance. (no ads, no registration) learn.microsoft.com/en-us/securi...
We need to have an honest conversation about legacy systems… Most organizations have unsupported systems that they aren’t able to change or move and this creates business risk. This is normal and common, no surprise. 🧵
The Azure Security Podcast episode just dropped for the new Security Adoption Framework (SAF) documentation. Podcast - azuresecuritypodcast.azurewebsites.net Docs - aka.ms/SAF
Are you still applying security patches as an exception? or patching by default? One of the biggest impacts of Mythos, MDASH, and other AI vuln discovery/exploit technologies is that you have to get really good at all aspects of software vulnerability management. 🧵
The SAF documentation site and June 2026 MCRA just went live on Microsoft Learn! Check it out and let us know what you think! aka.ms/SAF Note: This is the first release and we will be continuing to add to it. Send us your feedback, requests, and ideas.
Hey y'all I just recorded my first video in my new 'Mark on Cybersecurity' YouTube channel! Lots more to come! Let me know what you think and what topics you would like me to cover youtu.be/gKRWhAFQk4Y
Mark on Cybersecurity - Ep 1
YouTube video by Mark Simos
youtu.be
I keep hearing people are "Automating Tier 1 with AI" (or some other job) and I think words really matter here. ◾ Are you trying to replace a human person with AI? Assigning a human role to AI? ◾ Are you automating the tasks currently being done by people? a short 🧵
Security can never “win the game” - it's not the job we signed up for. We are the defense squad so we don't score goals or points - we just keep opponents from scoring points.
One of the most critical skillsets for CISOs is their ability to navigate the power structure of an organization (e.g. politics) I included this slide in my recent Tampa BSides talk (slides posted, recording pending) - zerotrustplaybook.com/events/ 🧵
Understanding and using the Why/What/How Chain is critical for everyone in security. I covered this in my Tampa BSides talk. Link to download the slides (and other past slides) here - zerotrustplaybook.com/events/ 🧵
I just posted the slides for my 'Security is a Team Sport (but we are NOT playing like a team)' session at BSides Tampa Check out the Events page for the link to those slides as well as videos/slides from previous talks. zerotrustplaybook.com/events/
Just putting the finishing touches on slides for my BSides Tampa talk "Security is a Team Sport ... but we are NOT playing as a team" Hope to see you there on Saturday!
"Somebody should do this" means "Nobody will do this" unless you assign a name.
I just posted the slides for my BSides South Florida talk on the events page zerotrustplaybook.com/events/
I recently did an interview-style session for an internal Microsoft team on why end to end security is so important and thought I would share my notes on the points to cover. 🧵
The Zero Trust Playbook site is live! It currently has a summary of the series, the outline of the first book, some information on the authors, and an events page with upcoming events and recordings. Much more to come in time!
The full length video has been posted for the announcement of the security roles and glossary standard! ◾ Video - www.youtube.com/watch?v=bMRr... ◾ Slides - www.slideshare.net/slideshow/se...
Are the people in your organization rewarded to ignore security?
One of the statements that really stuck with me from this episode was around the 'advanced persistent threat' terminology. Paraphrasing - the persistence is more important to attacker success than the advanced. I definitely recommend listening thecyberwire.com/podcasts/aft...
The full length video has been posted for the Security and Zero Trust body of knowledge session! www.youtube.com/watch?v=WaF6...
Security and Zero Trust Body of Knowledge
YouTube video by The Open Group
youtube.com
AI Inherits speed and scale from the GPUs it runs on, but it inherits unpredictability from the (social) human data it was trained on. a short 🧵
What does a CEO need to know about cybersecurity? See the (draft) Security Roles and Glossary standard for what knowledge, skills, & abilities are required of CEOs, board members, and other leaders (as well as accountabilities, fiduciary duty, & more). publications.opengroup.org/s252
Cybersecurity is often incorrectly seen as a 'technical problem' that can be 'solved' (it isn't!) by business leaders & others. *Security is an ongoing risk that requires ongoing work.* Security leaders often accidentally create or reinforce this misperception. a short 🧵
Think security can do it all on our own? WRONG! We must recognize that we are part of a larger team and each of us has a different part to play in protecting the organization. short 🧵
Want to lead Zero Trust marketing at Microsoft? apply.careers.microsoft.com/careers/job/...
Senior Product Marketing Manager | Microsoft Careers
Partner with Product Management and Engineering to shape the Zero Trust for AI product strategy, roadmap alignment, and customer-facing vision. * Lead cross-portfolio Zero Trust messaging and position...
apply.careers.microsoft.com
The video for my 'What's my job again' talk from BSides Tampa has posted Video - www.youtube.com/watch?v=uVAA... Slides - www.slideshare.net/slideshow/wh... Roles standard - publications.opengroup.org/s252
