Robert Wood

CISO | Servant Leader | Advisor | Lifelong Student (posts here are my own opinions and musings)

I have built, scaled, and run security programs as a CISO at 4 different organizations ranging from small tech startups to trillion dollar government organizations. The early part of my career was spent working in application security and red teaming. Cybersecurity is a passion of mine; using it to do amazing things is something that gets me fired up.

That’s why I founded Sidekick Security. To help organizations achieve security-led growth and digital transformations. In an age of trust as currency in so many industries, I believe this is the time when security truly can be an enabler. 

Beyond that, I am a lifelong learner. I love studying outside of my field and finding ways to expand the mental models I have to solve problems differently, more effectively, or to think about them in altogether new and fresh ways. 

Founder and CEO

Helping to connect SMBs and startups with exceptional security talent. A fresh, blue ocean strategy on the cyber security services market for organizations that really need it. 

The U.S. just made a few moves that as a red teamer and CISO, constitute a noteworthy shift in attack surface and risk posture.

And in part, we did it to ourselves.

Move 1: We gutted our biggest defense team.
CISA, the agency literally built to coordinate US cyber defense is operating at 38% staffing as of last month. Down from 3,400 to 2,400 people before the shutdown even hit. The counter-ransomware program? Gone. The acting associate director of the cybersecurity division? Resigning March 6. During an active conflict.

Move 2: We ripped out some of our best AI tooling.
The administration ordered every federal agency to immediately stop using AI tooling built by Anthropic, arguably the industry leader in AI capabilities and safety. The reason? Anthropic refused to let the Pentagon use its models for mass surveillance of Americans and autonomous weapons without guardrails. So now every federal agency and the DIB is moving to make non-trivial changes under the hood wherever Claude is used.

Move 3: The adversary went kinetic.
This is a big one...Iranian drones physically destroyed AWS data centers in the UAE and Bahrain on March 2. Banking systems went down. Payment processing stopped. Enterprise services across the Middle East reportedly went offline. This isn't a theoretical tabletop scenario. This happened four days ago. Our risk registers tend to think and operate in technical risk only, not accounting for environmental or kinetic issues, but this is very real.

Here's what I think should terrify every security leader reading this:

These aren't three separate stories. They're one story.
The US simultaneously reduced its human cyber defense capacity by 62%, removed the AI company that actually had safety principles from its toolkit, and watched a nation-state prove that cloud infrastructure is physically destroyable (or at least disruptable).

If you're running a security program right now, this is cause for some real conversation. The coordination layer you assumed would be there during a national incident is running on fumes so you may not be able to count on that resource like you expected. The AI tools the government is switching to were chosen for compliance or ease of contracting, not capability.

You should be planning to roll up your sleeves and get ready.

That means your detection has to be faster. Your response has to be automated. Your supply chain needs a threat-based perspective, not more questionnaires. Your resilience can't depend on a single cloud provider, a single government agency, or a single vendor's political alignment.

The organizations that thrive over the next couple of years, in my opinion won't be the ones waiting for federal guidance or seeing how the dust settles. They'll be the ones who build AI-native security stacks to complement their human teams. 

And it's only Wednesday! 

#ciso #aisecurity #nationalsecurity #cybersecurity

Helping CISOs and CIOs navigate their own cybersecurity transformations | Former Federal CISO

I almost got trampled by a bunch of horses last night bringing them in during the storm, here's what that taught me about cybersecurity.

...

...

Nothing! Those kinds of posts are ridiculous. That said, horses are funny, don't let your AI sessions let you think you're invincible out there once you get up from your comfy keyboard chair 😀 

#resiliency #ai

This won't be a sexy problem post.

With so many organizations aggressively adopting AI for everything from software engineering to content creation, I feel it's even more important today to ensure that you have human-driven or at least human-in-the-loop playbooks for things like incident response, business continuity, and disaster recovery. 

Like I said...definitely not sexy. 

But when your new vibe coding CS team ends up trashing production data or when your rogue, openclaw screws some key customer integration up, what do you do? 

Do you vibe respond your way out of it? How will that go over when you're catching questions from the board? 

#cybersecurity #aisecurity #businesscontinuity #incidentresponse

One of the most humbling things I've ever done professionally was go to a crypto conference around the time when SHA-3 was being reviewed. Slides full of intense math with active debates around the approaches. 

Now fast forward here we are...One of the most unfortunate things about this AI madness is that we are collectively not talking about some of the other major issues facing us.

For a very real example, the post-quantum crypto conversation is actively shifting from academic to practice. Encrypted data from two years ago is sitting in an adversary's storage cluster somewhere. They can't read it yet. They're waiting.

"Harvest now, decrypt later" is already happening per the NSA and CISA. Nation-state actors are collecting TLS sessions, VPN traffic, and encrypted transfers today, betting that cryptographically relevant quantum computers exist before 2035. NSS compliance requires migration to NIST-approved PQC algorithms by January 2027. Most organizations haven't inventoried their cryptographic dependencies, let alone sequenced a migration. 

We're already almost in Q2 of 2026. 

PQC migration is harder than most security projects because you can't patch your way through it. Discovery is the first problem, every system using RSA or ECDH for key exchange needs to be found, catalogued, and prioritized by data sensitivity and longevity. Since we've done such a crap job of basic asset management in nearly every other cyber-discipline, I imagine this is going to be a long pole in the tent. Hybrid cryptography (running classical and post-quantum algorithms in parallel) will buy time on external-facing systems while teams work through internal dependencies. But migration validation isn't a trivial issue, swapping cryptographic primitives can quietly break things that were working fine.

I suspect the organizations that will struggle most are the ones starting their discovery late. If an organization already struggles with basic discovery in other areas, it's likely this will be compounded. 

#ciso #ai #pqc #postquantum

Appsec went from one of the more bespoke disciplines in cyber to a near ubiquitous one.

The new BSIMM report still benchmarks software security maturity across organizations that think of themselves as software companies, those who are “writing software”. That frame is starting to crack though and quickly. When your finance team is building internal tools with Copilot, your ops team is shipping Python scripts with Codex, and your sales team is building wrappers around the GTM stack, you’re a software organization whether you planned for it or not.

The uncomfortable part isn’t that the code is bad (though often it is). It’s that most of these organizations have zero AppSec infrastructure around it. No code review. No SDLC. No threat modeling. Not even a basic inventory of what’s being built and deployed. No culture around building secure and resilient software.

The attack surface just exploded and security programs are still stuck on corpsec, GRC, running the SOC and so on.

BSIMM has always been valuable because it gives you a mirror, not a prescription. I got to live that up close during my time with Cigital. But the cohort it reflects is about to change dramatically over the next couple years. The organizations that need AppSec programs the most now are the ones that would never have shown up in a BSIMM assessment a few years ago.

If your org has AI coding tools in the hands of non-engineers, you already have an AppSec problem. You just might not have found it yet.

#bsimm #appsec #ai #aisecurity #ciso

No alternative text description for this image

A lot of the work our team has been doing around agentic security lately hasn't been "how do we prevent compromise?"

It's been all about sorting out how exposed "we" are if something does go wrong. This attack surface with AI is changing so quickly, I firmly believe pulling the focus back to sound platform and architecture design is key. 

This GlassWorm malware spent the first two weeks of March reportedly hitting over 400 repositories across Python, npm, and VSCode by poisoning the tooling that agents and developers both pull from. An agent ingesting a compromised dependency isn't a jailbroken model, it's a trusted process running a hostile payload. It's similar to your APIs pulling untrusted content and passing into databases or the user browser in a traditional appsec sense. 

Make that faster...autonomous systems don't pause between tool calls for an analyst to clear an alert. By the time detection fires (if it ever does because let's be real, monitoring is not ubiquitous), the tool chain has already run.

The threat model exercise worth doing for every agent in production is to assume full context window control. What can the attacker do? That answer drives real decisions from:
- Agent-specific service accounts scoped to what the agent needs (not the whole org)
- External API calls through an allowlisted proxy
- Async approval gates before high-impact write operations
- Session-isolated memory so context poisoning in one session doesn't persist into the next

And so on...

None of these are AI-specific controls, not really. They're least-privilege and separation-of-duty applied to a new surface.

So as a team building or adopting AI, if you can answer the blast radius question for every agent in production, you're doing yourself a big favor.

#cybersecurity #aisecurity #threatmodeling #ai

This drama unfolding with Delve is remarkable, yet totally believable.

Unfortunately there’s been so much emphasis placed on speeding through soc2 and other compliance requirements. 

The truth is, establishing compliant tech and doing config checks is easy. 

Getting the people and process legs of the stool takes time. 

It takes time because there’s tailoring to your culture and team. It requires alignment across leaders. It requires decisions about where to have friction in the name of security.

As an industry we’re so relentlessly focused on “tech-ifying” everything that we so quickly neglect the other elements of the job. 

For any companies that are dumping Delve or the GRC platforms, we’d love to talk to you about the work we’re doing at Sidekick Security. Our approach blends tech, people, and process with pre-built tools, skills, and workflows, but better than that, a relentless tailoring to your exact situation and goals.

You should be producing trust through your program. Not just dashboards. 

#ciso #delve #grc #aisecurity

Every vendor at RSA next week is going to tell you they deliver "outcomes, not tools."

They're right that the industry needed this correction. Buying 90 tools and hoping the Venn diagram of coverage eventually becomes a circle was never a winning strategy. But here's what I suspect is going to happen...the same companies that sold you shelf-ware or big heavy SaaS platforms for a decade are going to rebrand it as "outcome-driven" and change little except the slide deck. Tool vendors are still focused on their little slice of the ecosystem, their slice (however important that is) of the bigger problem domain that CISO's wrestle with.

Outcome-based security is a program design discipline, not a bucket of new features. And it requires several things that most haven't built or wouldn't want to IMHO:

1. A control baseline informed by your actual threat model (not a vendor's)
2. Metrics tied to business risk instead of vulnerability counts and other sort of vanity metrics
3. A feedback loop that changes how your team operates, not just what your dashboard shows
4. A roadmap that works to evolve your program such that the little slice of problem can hopefully be minimized (usually in direct conflict with growth goals for product vendors)

If your vendor is still overly emphasizing the outsized importance of their slice of the problem and isn't willing to talk about improvement measurements outside of their tools...you're getting a fancy AI-ified rebrand. 

#rsa #ciso #ai #cybersecurity

Drake meme joking about buying 47 best-in-class tools and hoping for integration versus buying 47 different outcomes and hoping all the platforms talk to each other

Sean Doherty

What does GovDash do?

GovDash is the AI platform for winning government contracts. Produce high-quality proposals, run capture, organize your data, and a whole lot more. All in one place. Replace multiple broken tools with GovDash, the platform designed to make your business development team more effective—and happier.

We are supported by top investors such as:

▹ Y combinator
▹ Northzone
▹ Craft Ventures
▹ Soma Capital
▹ Global Founders Capital
▹ Olive Tree Capital

How To Get In Touch?

▹ Book a meeting on our website: https://govdash.com/

Co-Founder & CEO

We've all experienced frustration when working with data tools - 74% of employees feel unhappy or overwhelmed when working with data. We founded Olli.ai to reimagine the way that teams work with data, leveraging state-of-the-art AI models to help people get their data questions answered in seconds.

Snow storm didn't stop us from getting to the office today (don't worry, it was optional for the team) - too many things going on at GovDash to stay home!

- New Pricer product
- Updated opportunity identification algorithm - find good-fit opps faster
- Brand new reporting capabilities
- Major agentic features added to Dash - spin up almost any workflow
- Past performance and custom data calls
- And so much more (GovDash customers, check the changelog from Friday!)

CEO at GovDash - AI platform for winning government contracts

Launching GovDash Discover.

We just shipped something we've wanted to build for a long time: a free, public site that gives any company instant access to government opportunities with a recommendation feed tailored to their business.

A few things worth noting:

This is not the GovDash platform. Discover is a totally separate site. Our platform is where teams run capture workflows, build competitive cost quotes, produce compliant proposals, manage contracts, and more. The value of GovDash has always been in the work you do on top of opportunity data, not in aggregating it.

So why give this away? Because opportunity data is publicly available. We got tired of watching vendors charge small businesses thousands of dollars a year just to repackage it. So we built Discover and made it 100% free.

It gets smarter the more you use it. Look up your company and Discover will tune your feed based on your contract history on USASpending.

Want even better results? Talk to our team about the full GovDash platform, where you can layer in your contract docs, and company knowledge.

Happy hunting → https://lnkd.in/eZHxQ8t4

David Blackburn and I discuss GovDash’s new pricing features, why we raised another $30M, and how we think about building agents.

Thanks David!

Listen to this episode of GovCon Executive Slice as CEO Sean Doherty joins David Blackburn to discuss the future of AI in GovCon. They cover GovDash’s new Pricer product, an upgraded pursuit-matching algorithm, and one bold prediction for where GovCon AI and the federal market could be by 2027.

🎙️ Listen here: https://lnkd.in/g79F-6eN

🍊 See more from The Peel and our other podcast series here: https://lnkd.in/eG6E5E33
#orangeslicespodcast #GovConExecutiveSlice #AI #GovConAI 
Amanda Schrauben | David Blackburn | Heather Seftel-Kirk | Andréa Leichtman | Tara Marcoux-Tynski, CRAE

I've been thinking a lot about how AI application design maps to organizational design. The best vertical AI products aren't copilots. They're agent harnesses: systems where agents do the work, and everything else (context, tools, evaluation, human judgment) exists to make that work excellent.

I think companies themselves are heading in this direction. Wrote about it here.

To understand how the organization of companies will evolve over the next few years, look at the design of today's best vertical AI applications. They

Open article: Your Company Is a Harness by Sean Doherty • 7 min read

Congrats to Gavin - full speed ahead solving customer problems at GovDash!

Almost two years ago, I joined GovDash as the engineer building out our Capture Cloud. Today, I’m proud to announce I’m stepping into the role of Head of Engineering.

When I started, the Capture Cloud was in its infancy. I got to build it from the ground up - and it’s now our most-used product area, helping government contractors manage their pipeline, qualify opportunities, and develop winning strategies.

What’s made this journey special is that GovDash isn’t a place where you just ship code. You have the privilege of talking with customers daily. You learn the domain. You understand why what you’re building matters.

Since I joined, we’ve grown from a handful of engineers to a full team across Capture, Discover, Pricer, Proposal, Contract, Data Library, and Dash. We closed a $30M Series B. We’ve made hundreds of customers lives easier. And we’re just getting started.

I’m incredibly grateful to Sean Doherty, Curtis Mason, Timothy Goltser, and the entire GovDash team for the trust and the opportunity. Now it’s time to scale - the platform, the team, and the impact.

We’re hiring engineers for our Manhattan office. If you’re tired of building API wrappers and want to build AI that has to actually be right (FedRAMP-compliant, traceable, and trusted by defense contractors) let’s talk.

taplio

The Battle

Robert Wood

Sean Doherty

Followers

Posts

Engagements

Likes

Performance ScoreRobert Wood's LinkedIn Performance

Performance ScoreSean Doherty's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Robert Wood

Sean Doherty

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Robert Wood's LinkedIn Performance

Performance ScoreSean Doherty's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreRobert Wood's LinkedIn Performance