Robert Wood

CISO | Servant Leader | Advisor | Lifelong Student (posts here are my own opinions and musings)

I have built, scaled, and run security programs as a CISO at 4 different organizations ranging from small tech startups to trillion dollar government organizations. The early part of my career was spent working in application security and red teaming. Cybersecurity is a passion of mine; using it to do amazing things is something that gets me fired up.

That’s why I founded Sidekick Security. To help organizations achieve security-led growth and digital transformations. In an age of trust as currency in so many industries, I believe this is the time when security truly can be an enabler. 

Beyond that, I am a lifelong learner. I love studying outside of my field and finding ways to expand the mental models I have to solve problems differently, more effectively, or to think about them in altogether new and fresh ways. 

Founder and CEO

Helping to connect SMBs and startups with exceptional security talent. A fresh, blue ocean strategy on the cyber security services market for organizations that really need it. 

The U.S. just made a few moves that as a red teamer and CISO, constitute a noteworthy shift in attack surface and risk posture.

And in part, we did it to ourselves.

Move 1: We gutted our biggest defense team.
CISA, the agency literally built to coordinate US cyber defense is operating at 38% staffing as of last month. Down from 3,400 to 2,400 people before the shutdown even hit. The counter-ransomware program? Gone. The acting associate director of the cybersecurity division? Resigning March 6. During an active conflict.

Move 2: We ripped out some of our best AI tooling.
The administration ordered every federal agency to immediately stop using AI tooling built by Anthropic, arguably the industry leader in AI capabilities and safety. The reason? Anthropic refused to let the Pentagon use its models for mass surveillance of Americans and autonomous weapons without guardrails. So now every federal agency and the DIB is moving to make non-trivial changes under the hood wherever Claude is used.

Move 3: The adversary went kinetic.
This is a big one...Iranian drones physically destroyed AWS data centers in the UAE and Bahrain on March 2. Banking systems went down. Payment processing stopped. Enterprise services across the Middle East reportedly went offline. This isn't a theoretical tabletop scenario. This happened four days ago. Our risk registers tend to think and operate in technical risk only, not accounting for environmental or kinetic issues, but this is very real.

Here's what I think should terrify every security leader reading this:

These aren't three separate stories. They're one story.
The US simultaneously reduced its human cyber defense capacity by 62%, removed the AI company that actually had safety principles from its toolkit, and watched a nation-state prove that cloud infrastructure is physically destroyable (or at least disruptable).

If you're running a security program right now, this is cause for some real conversation. The coordination layer you assumed would be there during a national incident is running on fumes so you may not be able to count on that resource like you expected. The AI tools the government is switching to were chosen for compliance or ease of contracting, not capability.

You should be planning to roll up your sleeves and get ready.

That means your detection has to be faster. Your response has to be automated. Your supply chain needs a threat-based perspective, not more questionnaires. Your resilience can't depend on a single cloud provider, a single government agency, or a single vendor's political alignment.

The organizations that thrive over the next couple of years, in my opinion won't be the ones waiting for federal guidance or seeing how the dust settles. They'll be the ones who build AI-native security stacks to complement their human teams. 

And it's only Wednesday! 

#ciso #aisecurity #nationalsecurity #cybersecurity

Helping CISOs and CIOs navigate their own cybersecurity transformations | Former Federal CISO

I almost got trampled by a bunch of horses last night bringing them in during the storm, here's what that taught me about cybersecurity.

...

...

Nothing! Those kinds of posts are ridiculous. That said, horses are funny, don't let your AI sessions let you think you're invincible out there once you get up from your comfy keyboard chair 😀 

#resiliency #ai

This won't be a sexy problem post.

With so many organizations aggressively adopting AI for everything from software engineering to content creation, I feel it's even more important today to ensure that you have human-driven or at least human-in-the-loop playbooks for things like incident response, business continuity, and disaster recovery. 

Like I said...definitely not sexy. 

But when your new vibe coding CS team ends up trashing production data or when your rogue, openclaw screws some key customer integration up, what do you do? 

Do you vibe respond your way out of it? How will that go over when you're catching questions from the board? 

#cybersecurity #aisecurity #businesscontinuity #incidentresponse

One of the most humbling things I've ever done professionally was go to a crypto conference around the time when SHA-3 was being reviewed. Slides full of intense math with active debates around the approaches. 

Now fast forward here we are...One of the most unfortunate things about this AI madness is that we are collectively not talking about some of the other major issues facing us.

For a very real example, the post-quantum crypto conversation is actively shifting from academic to practice. Encrypted data from two years ago is sitting in an adversary's storage cluster somewhere. They can't read it yet. They're waiting.

"Harvest now, decrypt later" is already happening per the NSA and CISA. Nation-state actors are collecting TLS sessions, VPN traffic, and encrypted transfers today, betting that cryptographically relevant quantum computers exist before 2035. NSS compliance requires migration to NIST-approved PQC algorithms by January 2027. Most organizations haven't inventoried their cryptographic dependencies, let alone sequenced a migration. 

We're already almost in Q2 of 2026. 

PQC migration is harder than most security projects because you can't patch your way through it. Discovery is the first problem, every system using RSA or ECDH for key exchange needs to be found, catalogued, and prioritized by data sensitivity and longevity. Since we've done such a crap job of basic asset management in nearly every other cyber-discipline, I imagine this is going to be a long pole in the tent. Hybrid cryptography (running classical and post-quantum algorithms in parallel) will buy time on external-facing systems while teams work through internal dependencies. But migration validation isn't a trivial issue, swapping cryptographic primitives can quietly break things that were working fine.

I suspect the organizations that will struggle most are the ones starting their discovery late. If an organization already struggles with basic discovery in other areas, it's likely this will be compounded. 

#ciso #ai #pqc #postquantum

Appsec went from one of the more bespoke disciplines in cyber to a near ubiquitous one.

The new BSIMM report still benchmarks software security maturity across organizations that think of themselves as software companies, those who are “writing software”. That frame is starting to crack though and quickly. When your finance team is building internal tools with Copilot, your ops team is shipping Python scripts with Codex, and your sales team is building wrappers around the GTM stack, you’re a software organization whether you planned for it or not.

The uncomfortable part isn’t that the code is bad (though often it is). It’s that most of these organizations have zero AppSec infrastructure around it. No code review. No SDLC. No threat modeling. Not even a basic inventory of what’s being built and deployed. No culture around building secure and resilient software.

The attack surface just exploded and security programs are still stuck on corpsec, GRC, running the SOC and so on.

BSIMM has always been valuable because it gives you a mirror, not a prescription. I got to live that up close during my time with Cigital. But the cohort it reflects is about to change dramatically over the next couple years. The organizations that need AppSec programs the most now are the ones that would never have shown up in a BSIMM assessment a few years ago.

If your org has AI coding tools in the hands of non-engineers, you already have an AppSec problem. You just might not have found it yet.

#bsimm #appsec #ai #aisecurity #ciso

No alternative text description for this image

A lot of the work our team has been doing around agentic security lately hasn't been "how do we prevent compromise?"

It's been all about sorting out how exposed "we" are if something does go wrong. This attack surface with AI is changing so quickly, I firmly believe pulling the focus back to sound platform and architecture design is key. 

This GlassWorm malware spent the first two weeks of March reportedly hitting over 400 repositories across Python, npm, and VSCode by poisoning the tooling that agents and developers both pull from. An agent ingesting a compromised dependency isn't a jailbroken model, it's a trusted process running a hostile payload. It's similar to your APIs pulling untrusted content and passing into databases or the user browser in a traditional appsec sense. 

Make that faster...autonomous systems don't pause between tool calls for an analyst to clear an alert. By the time detection fires (if it ever does because let's be real, monitoring is not ubiquitous), the tool chain has already run.

The threat model exercise worth doing for every agent in production is to assume full context window control. What can the attacker do? That answer drives real decisions from:
- Agent-specific service accounts scoped to what the agent needs (not the whole org)
- External API calls through an allowlisted proxy
- Async approval gates before high-impact write operations
- Session-isolated memory so context poisoning in one session doesn't persist into the next

And so on...

None of these are AI-specific controls, not really. They're least-privilege and separation-of-duty applied to a new surface.

So as a team building or adopting AI, if you can answer the blast radius question for every agent in production, you're doing yourself a big favor.

#cybersecurity #aisecurity #threatmodeling #ai

This drama unfolding with Delve is remarkable, yet totally believable.

Unfortunately there’s been so much emphasis placed on speeding through soc2 and other compliance requirements. 

The truth is, establishing compliant tech and doing config checks is easy. 

Getting the people and process legs of the stool takes time. 

It takes time because there’s tailoring to your culture and team. It requires alignment across leaders. It requires decisions about where to have friction in the name of security.

As an industry we’re so relentlessly focused on “tech-ifying” everything that we so quickly neglect the other elements of the job. 

For any companies that are dumping Delve or the GRC platforms, we’d love to talk to you about the work we’re doing at Sidekick Security. Our approach blends tech, people, and process with pre-built tools, skills, and workflows, but better than that, a relentless tailoring to your exact situation and goals.

You should be producing trust through your program. Not just dashboards. 

#ciso #delve #grc #aisecurity

Every vendor at RSA next week is going to tell you they deliver "outcomes, not tools."

They're right that the industry needed this correction. Buying 90 tools and hoping the Venn diagram of coverage eventually becomes a circle was never a winning strategy. But here's what I suspect is going to happen...the same companies that sold you shelf-ware or big heavy SaaS platforms for a decade are going to rebrand it as "outcome-driven" and change little except the slide deck. Tool vendors are still focused on their little slice of the ecosystem, their slice (however important that is) of the bigger problem domain that CISO's wrestle with.

Outcome-based security is a program design discipline, not a bucket of new features. And it requires several things that most haven't built or wouldn't want to IMHO:

1. A control baseline informed by your actual threat model (not a vendor's)
2. Metrics tied to business risk instead of vulnerability counts and other sort of vanity metrics
3. A feedback loop that changes how your team operates, not just what your dashboard shows
4. A roadmap that works to evolve your program such that the little slice of problem can hopefully be minimized (usually in direct conflict with growth goals for product vendors)

If your vendor is still overly emphasizing the outsized importance of their slice of the problem and isn't willing to talk about improvement measurements outside of their tools...you're getting a fancy AI-ified rebrand. 

#rsa #ciso #ai #cybersecurity

Drake meme joking about buying 47 best-in-class tools and hoping for integration versus buying 47 different outcomes and hoping all the platforms talk to each other

Datadog

As agencies take on secure-by-design initiatives and scale under mandates like M-15-14, M-21-31, EO 14028, and FISMA, the pressure to move quickly, reduce risk, and prove readiness keeps growing.

I work with federal teams (and the FSIs that support them) to bring clarity across the stack, from infrastructure to applications, performance to posture. Most friction comes from legacy decisions, siloed teams, and blind spots across environments.

Here’s how I help cut through the noise:
- Unify observability across hybrid and multi-cloud platforms
- Reduce tool sprawl and operational overhead
- Connect ops, security, and modernization priorities
- Support faster troubleshooting and more resilient systems

Here’s how other agencies are approaching it:

Strategic Account Executive, Federal Civilian

Tanium

Supported Civilian agencies in advancing EO 14028, M-22-09, CDM, and FISMA priorities through real-time endpoint visibility and control. Focused on helping agencies shift from legacy tools to unified, modern platforms aligned with Zero Trust and risk-based initiatives.

Collaborated with FSIs and partners like ServiceNow to support integrated modernization strategies. Led long-view engagement in environments where Tanium was not previously considered, requiring trust, education, and mission alignment.

Generated $5M+ in new pipeline through strategic entry points (not expansions), laying the groundwork for durable, agency-wide transformation.

Director of Strategic Accounts, Federal Civilian

RSA Security

Archer is an eGRC platform that helps organizations identify, manage, and report risk across IT, business, and third-party environments while streamlining compliance and improving accountability.

Responsible for hunting new logos and driving growth across Federal and Enterprise markets in New England as part of a newly launched Business Development team.

• Won largest new business of 2022 (~$3.2M TCV) by helping a GSE modernize its GRC posture
• During the same period, tapped to cover an open territory and secured $6M in renewals and upsells in 6 months
• Delivered ~$9M in customer impact by aligning security investments with mission and regulatory goals
•Won 8 new enterprise logos by end of FY21

Business Development Manager, Archer

Retained and upsold ~$5M by aligning to agency GRC needs, and delivering maturity-based solutions mapped to FISMA and NIST RMF requirements.

Account Manager, Archer Federal

SecurID provides powerful identity and access management capabilities in authentication, access management, and identity governance – to fully protect organizations in a world without boundaries.

Retained ~$4M in federal accounts and drove new license growth by positioning SecurID as a foundational pillar of Zero Trust. Supported FedRAMP authorization to accelerate cloud adoption across the public sector.

Account Manager, SecurID Federal

Business Development Representative

Colette Phillips Communications

Promoted within a year to serve in dual roles: Account Executive, focused on driving revenue, and Chief of Staff, supporting strategic initiatives and executive alignment

Led high-impact diversity and inclusion initiatives across Boston, partnering with CEO Colette Phillips to develop strategic plans that drove meaningful change and elevated brand presence. Managed high-profile projects, secured widespread media coverage and engaged with C-level executives and political leaders.

Coordinated functional teams and ensured seamless execution of initiative designed to foster a more inclusive, equitable community, while balancing revenue-generating responsibilities on behalf of the firm.

Chief of Staff / Account Executive

minus5º ICEBAR

Photographer

Staff International

As a member of the North American Press & Communications team for Maison Martin Margiela, MM6, and Dsquared2, I managed sample logistics for top fashion outlets, red carpet events, and TV/film productions. I oversaw sample loan traffic, ensuring seamless send-outs and returns from celebrity stylists, fashion editors, and production teams at publications like Vogue, Elle, and WWD. I was also responsible for tracking and analyzing brand visibility—maintaining editorial and credit request charts, monitoring press coverage across daily, weekly, and monthly publications, and compiling detailed media reports to measure impact.

Press Communications Intern

✨  I grew up code-switching between Hiligaynon, Tagalog, and English, which meant paying close attention to what’s said and unsaid: tone, timing, subtext.

Somewhere along the way, it became the backbone of how I communicate. It taught me how to read between the lines, stay tuned into dynamics, and bring clarity into messy spaces. Skills that serve me well in FedIT where priorities are always shifting, mandates keep changing, and decisions are layered.

Over time, I’ve learned that in environments like these, clarity builds trust. It shows you’re listening, you understand the stakes, can help teams move with confidence, and make the complex feel doable.

This is the kind of work I get to be part of every day and it's why I love what I do. The problem-solving, the relationships that outlast a sales cycle, and the outcomes we build together.

Whether it’s CloudSmart, CDM, EO 14028, M-21-31, or whatever acronym lands next, I help agencies move the needle. Securely. Intentionally. Strategically.

If this sounds like the kind of partner you want in your corner, let’s connect! 

If not, no worries. We’ll probably cross paths 😏👀

#GovCon #FederalIT #Cybersecurity #ITModernization #Observability

taplio

The Battle

Robert Wood

April P.

Followers

Posts

Engagements

Likes

Performance ScoreRobert Wood's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Robert Wood

April P.

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Robert Wood's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreRobert Wood's LinkedIn Performance