Robert Wood

CISO | Servant Leader | Advisor | Lifelong Student (posts here are my own opinions and musings)

I have built, scaled, and run security programs as a CISO at 4 different organizations ranging from small tech startups to trillion dollar government organizations. The early part of my career was spent working in application security and red teaming. Cybersecurity is a passion of mine; using it to do amazing things is something that gets me fired up.

That’s why I founded Sidekick Security. To help organizations achieve security-led growth and digital transformations. In an age of trust as currency in so many industries, I believe this is the time when security truly can be an enabler. 

Beyond that, I am a lifelong learner. I love studying outside of my field and finding ways to expand the mental models I have to solve problems differently, more effectively, or to think about them in altogether new and fresh ways. 

Founder and CEO

Helping to connect SMBs and startups with exceptional security talent. A fresh, blue ocean strategy on the cyber security services market for organizations that really need it. 

The U.S. just made a few moves that as a red teamer and CISO, constitute a noteworthy shift in attack surface and risk posture.

And in part, we did it to ourselves.

Move 1: We gutted our biggest defense team.
CISA, the agency literally built to coordinate US cyber defense is operating at 38% staffing as of last month. Down from 3,400 to 2,400 people before the shutdown even hit. The counter-ransomware program? Gone. The acting associate director of the cybersecurity division? Resigning March 6. During an active conflict.

Move 2: We ripped out some of our best AI tooling.
The administration ordered every federal agency to immediately stop using AI tooling built by Anthropic, arguably the industry leader in AI capabilities and safety. The reason? Anthropic refused to let the Pentagon use its models for mass surveillance of Americans and autonomous weapons without guardrails. So now every federal agency and the DIB is moving to make non-trivial changes under the hood wherever Claude is used.

Move 3: The adversary went kinetic.
This is a big one...Iranian drones physically destroyed AWS data centers in the UAE and Bahrain on March 2. Banking systems went down. Payment processing stopped. Enterprise services across the Middle East reportedly went offline. This isn't a theoretical tabletop scenario. This happened four days ago. Our risk registers tend to think and operate in technical risk only, not accounting for environmental or kinetic issues, but this is very real.

Here's what I think should terrify every security leader reading this:

These aren't three separate stories. They're one story.
The US simultaneously reduced its human cyber defense capacity by 62%, removed the AI company that actually had safety principles from its toolkit, and watched a nation-state prove that cloud infrastructure is physically destroyable (or at least disruptable).

If you're running a security program right now, this is cause for some real conversation. The coordination layer you assumed would be there during a national incident is running on fumes so you may not be able to count on that resource like you expected. The AI tools the government is switching to were chosen for compliance or ease of contracting, not capability.

You should be planning to roll up your sleeves and get ready.

That means your detection has to be faster. Your response has to be automated. Your supply chain needs a threat-based perspective, not more questionnaires. Your resilience can't depend on a single cloud provider, a single government agency, or a single vendor's political alignment.

The organizations that thrive over the next couple of years, in my opinion won't be the ones waiting for federal guidance or seeing how the dust settles. They'll be the ones who build AI-native security stacks to complement their human teams. 

And it's only Wednesday! 

#ciso #aisecurity #nationalsecurity #cybersecurity

Helping CISOs and CIOs navigate their own cybersecurity transformations | Former Federal CISO

I almost got trampled by a bunch of horses last night bringing them in during the storm, here's what that taught me about cybersecurity.

...

...

Nothing! Those kinds of posts are ridiculous. That said, horses are funny, don't let your AI sessions let you think you're invincible out there once you get up from your comfy keyboard chair 😀 

#resiliency #ai

This won't be a sexy problem post.

With so many organizations aggressively adopting AI for everything from software engineering to content creation, I feel it's even more important today to ensure that you have human-driven or at least human-in-the-loop playbooks for things like incident response, business continuity, and disaster recovery. 

Like I said...definitely not sexy. 

But when your new vibe coding CS team ends up trashing production data or when your rogue, openclaw screws some key customer integration up, what do you do? 

Do you vibe respond your way out of it? How will that go over when you're catching questions from the board? 

#cybersecurity #aisecurity #businesscontinuity #incidentresponse

One of the most humbling things I've ever done professionally was go to a crypto conference around the time when SHA-3 was being reviewed. Slides full of intense math with active debates around the approaches. 

Now fast forward here we are...One of the most unfortunate things about this AI madness is that we are collectively not talking about some of the other major issues facing us.

For a very real example, the post-quantum crypto conversation is actively shifting from academic to practice. Encrypted data from two years ago is sitting in an adversary's storage cluster somewhere. They can't read it yet. They're waiting.

"Harvest now, decrypt later" is already happening per the NSA and CISA. Nation-state actors are collecting TLS sessions, VPN traffic, and encrypted transfers today, betting that cryptographically relevant quantum computers exist before 2035. NSS compliance requires migration to NIST-approved PQC algorithms by January 2027. Most organizations haven't inventoried their cryptographic dependencies, let alone sequenced a migration. 

We're already almost in Q2 of 2026. 

PQC migration is harder than most security projects because you can't patch your way through it. Discovery is the first problem, every system using RSA or ECDH for key exchange needs to be found, catalogued, and prioritized by data sensitivity and longevity. Since we've done such a crap job of basic asset management in nearly every other cyber-discipline, I imagine this is going to be a long pole in the tent. Hybrid cryptography (running classical and post-quantum algorithms in parallel) will buy time on external-facing systems while teams work through internal dependencies. But migration validation isn't a trivial issue, swapping cryptographic primitives can quietly break things that were working fine.

I suspect the organizations that will struggle most are the ones starting their discovery late. If an organization already struggles with basic discovery in other areas, it's likely this will be compounded. 

#ciso #ai #pqc #postquantum

Appsec went from one of the more bespoke disciplines in cyber to a near ubiquitous one.

The new BSIMM report still benchmarks software security maturity across organizations that think of themselves as software companies, those who are “writing software”. That frame is starting to crack though and quickly. When your finance team is building internal tools with Copilot, your ops team is shipping Python scripts with Codex, and your sales team is building wrappers around the GTM stack, you’re a software organization whether you planned for it or not.

The uncomfortable part isn’t that the code is bad (though often it is). It’s that most of these organizations have zero AppSec infrastructure around it. No code review. No SDLC. No threat modeling. Not even a basic inventory of what’s being built and deployed. No culture around building secure and resilient software.

The attack surface just exploded and security programs are still stuck on corpsec, GRC, running the SOC and so on.

BSIMM has always been valuable because it gives you a mirror, not a prescription. I got to live that up close during my time with Cigital. But the cohort it reflects is about to change dramatically over the next couple years. The organizations that need AppSec programs the most now are the ones that would never have shown up in a BSIMM assessment a few years ago.

If your org has AI coding tools in the hands of non-engineers, you already have an AppSec problem. You just might not have found it yet.

#bsimm #appsec #ai #aisecurity #ciso

No alternative text description for this image

A lot of the work our team has been doing around agentic security lately hasn't been "how do we prevent compromise?"

It's been all about sorting out how exposed "we" are if something does go wrong. This attack surface with AI is changing so quickly, I firmly believe pulling the focus back to sound platform and architecture design is key. 

This GlassWorm malware spent the first two weeks of March reportedly hitting over 400 repositories across Python, npm, and VSCode by poisoning the tooling that agents and developers both pull from. An agent ingesting a compromised dependency isn't a jailbroken model, it's a trusted process running a hostile payload. It's similar to your APIs pulling untrusted content and passing into databases or the user browser in a traditional appsec sense. 

Make that faster...autonomous systems don't pause between tool calls for an analyst to clear an alert. By the time detection fires (if it ever does because let's be real, monitoring is not ubiquitous), the tool chain has already run.

The threat model exercise worth doing for every agent in production is to assume full context window control. What can the attacker do? That answer drives real decisions from:
- Agent-specific service accounts scoped to what the agent needs (not the whole org)
- External API calls through an allowlisted proxy
- Async approval gates before high-impact write operations
- Session-isolated memory so context poisoning in one session doesn't persist into the next

And so on...

None of these are AI-specific controls, not really. They're least-privilege and separation-of-duty applied to a new surface.

So as a team building or adopting AI, if you can answer the blast radius question for every agent in production, you're doing yourself a big favor.

#cybersecurity #aisecurity #threatmodeling #ai

This drama unfolding with Delve is remarkable, yet totally believable.

Unfortunately there’s been so much emphasis placed on speeding through soc2 and other compliance requirements. 

The truth is, establishing compliant tech and doing config checks is easy. 

Getting the people and process legs of the stool takes time. 

It takes time because there’s tailoring to your culture and team. It requires alignment across leaders. It requires decisions about where to have friction in the name of security.

As an industry we’re so relentlessly focused on “tech-ifying” everything that we so quickly neglect the other elements of the job. 

For any companies that are dumping Delve or the GRC platforms, we’d love to talk to you about the work we’re doing at Sidekick Security. Our approach blends tech, people, and process with pre-built tools, skills, and workflows, but better than that, a relentless tailoring to your exact situation and goals.

You should be producing trust through your program. Not just dashboards. 

#ciso #delve #grc #aisecurity

Every vendor at RSA next week is going to tell you they deliver "outcomes, not tools."

They're right that the industry needed this correction. Buying 90 tools and hoping the Venn diagram of coverage eventually becomes a circle was never a winning strategy. But here's what I suspect is going to happen...the same companies that sold you shelf-ware or big heavy SaaS platforms for a decade are going to rebrand it as "outcome-driven" and change little except the slide deck. Tool vendors are still focused on their little slice of the ecosystem, their slice (however important that is) of the bigger problem domain that CISO's wrestle with.

Outcome-based security is a program design discipline, not a bucket of new features. And it requires several things that most haven't built or wouldn't want to IMHO:

1. A control baseline informed by your actual threat model (not a vendor's)
2. Metrics tied to business risk instead of vulnerability counts and other sort of vanity metrics
3. A feedback loop that changes how your team operates, not just what your dashboard shows
4. A roadmap that works to evolve your program such that the little slice of problem can hopefully be minimized (usually in direct conflict with growth goals for product vendors)

If your vendor is still overly emphasizing the outsized importance of their slice of the problem and isn't willing to talk about improvement measurements outside of their tools...you're getting a fancy AI-ified rebrand. 

#rsa #ciso #ai #cybersecurity

Drake meme joking about buying 47 best-in-class tools and hoping for integration versus buying 47 different outcomes and hoping all the platforms talk to each other

taplio