Vulners – Security Intelligence Data Feed

Vulners provides the most complete, constantly updated, highly correlated, structured vulnerabilities data – both in human and machine-readable formats.

Head of Revenue

Business Development Manager

Help technology startups streamline clients acquisition processes and improve products monetization.

•	Work with founders to identify growth opportunities and find new sales channels.
•	Digitize key funnel metrics and help find a way to improve them.
•	Put together a minimal but efficient sales tech stack to enable processes scalability.
•	Help to implement and pilot various lead-generation strategies.
•	Drive key deals with enterprise customers and partners.

Business Development and Growth Consulting

Develonica

Lead international business development department for custom software development company.

•	Responsible for attaining business unit revenue and growth targets – achieved Financial Year 2021 targets both in terms of revenue and number of new clients.
•	Drive key deals from lead stage to signed contract, team deployment, and recognized revenue.
•	Enable the sales team to implement new approaches and transform the processes to achieve a new level of effectiveness and efficiency.
•	Integrate business unit into multinational holding organization to reach synergy with other acquisitions, country offices, various sales and product teams, and business units.
•	Hire new team members with various roles (marketing, sales executive), new hires onboarding and adaptation, setting up KPIs, and enable people to achieve them.

Director, International Business Development

QIWI Blockchain Technologies

Work at innovation laboratory that focused on finding for Qiwi way to profitably utilize blockchain technologies.

•	Blockchain strategy development and execution – formulate and test multiple hypotheses for Qiwi to profitably engage in Distributed Ledger Technology (DLT) space.
•	Lead partnerships with international consortia and companies with a focus on cross-border DLT-based payment solutions.
•	Develop internal knowledge and understanding of payment solutions based on distributed ledger technologies and Central Bank Digital Currencies.

Director, International Markets and Partnerships

Thomson Reuters

Drive projects and partnerships to boost company revenue from Enterprise Solutions – machine-readable data sources accessible via APIs and integrations.

•	Scouting, evaluation, prioritization, and execution of new partnership opportunities – enabling and facilitating deals that leveraged TR data being available in third-party products via APIs and integrations.
•	Active selling of partners’ products – driving deals from lead generation to closure.
•	Launch in Russia and migrate clients from on-prem software to managed solution (Software-as-a-Service), including business case development, work with local suppliers, launch marketing program, sales strategy creation and execution.
•	Develop business cases to support investment projects.
•	Lead revenue retention program in the Enterprise Solutions segment.
•	Work with FinTech companies to find new opportunities and solutions in BOLD (Big, Open, Linked Data), Machine Learning, and Blockchain.

Enterprise Business Development & Partnerships Manager

CRIF

Sell low-code data-driven loan origination automation solutions for banks.

•	Find and help realize new business opportunities via selling software licenses bundled with professional services as a tailored solution for loan origination automation.
•	Drive the pre-sale process (presentations, demos, requirements elicitation); coordinate local and Italian product experts' work; prepare RFI responses and commercial proposals. 
•	Negotiate deals and support the legal department in the contracting process.

Sales Executive

Luxoft

Manage custom software development project for Boeing.

•	Manage 10+ people distributed project teams entirely responsible for work planning and execution, reaching milestones and meeting deadlines, ensuring deliverables quality, and overall customer satisfaction.
•	Put together technical and commercial proposals for competitive bids — the sales organization led the process but heavily relied on engineering teams' inputs.

Project Manager, Boeing DC

Aligned Ventures

• Participate in consulting engagements with Russian and foreign companies.
• Prepare commercial proposals and contracts.

Organizational Development Consultant

EGAR Technology

Manage 10+ people distributed team to design and develop Internet based and desktop tools for stock options ranking and data analysis taking responsibility for products delivery and quality.

Project Manager

Actis Systems

Lead team of developers in Internet based solutions development projects.

Senior Software Developer

Zero False-Positive Vulnerabilities Assessment | B2B SaaS | GoToMarket | Startup Advisor

I've run sales and engineering teams, launched products in new markets bringing them from zero to over million USD in ARR.

Software engineer by education and trade, I spent most of my time in sales and business development roles.

Fan of first-principles thinking and bigger-than-life engineering projects of Elon Musk, David Deutsch works, and fat-tail risk framework.

I'm happy to exchange opinions and professional insights. Please connect, drop me a message here, or email me at la@vulners.com.

Even though we don't have as much data as Richard Stiennon from IT-Harvest, we can still draw fascinating insights from the approximately 30,000 Vulners – Security Intelligence Data Feed website visitors who were tagged by LinkedIn.

For instance, the map here depicts the top 100 #cybersecurity cities worldwide.

If questioned unexpectedly, I would likely only correctly guess one or two of the top ten contenders:

- Bengaluru leads by a substantial margin.
- With Bengaluru, Hyderabad, Mumbai, Pune, and Chennai, India 🇮🇳 holds five spots in the top 10.
- Surprisingly enough, Singapore 🇸🇬 holds the third spot.
- São Paulo 🇧🇷 is in fifth, narrowly surpassing New York 🇺🇸.
- And unexpectedly, we have more visitors from Sydney 🇦🇺 (8th) than from London 🇬🇧 (10th).

If you reside in one of these less known cybersecurity capitals, feel free to say hello in the comments 😎.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Andrey Lukashenkov

No alternative text description for this image

By 2025, we could see 500+ new software #vulnerabilities every week! 

CVEs are growing like crazy, thanks to more software vendors, CVE Naming Authorities, and vulnerability research. 

With organizations backlogging over 100,000 vulnerabilities and an ever-growing attack surface, it's crucial to recognize the asymmetry between malicious actors' exploitation windows and remediation timelines. 

Countless insights from Cyentia Institute research! 💻🛡️

https://lnkd.in/dM25Nmm3

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Look, Mom, no hands! #gpt4 whipped up a program just for me! Here's the story 👇👇👇

I had to sift through some gnarly technical logs to prep for a conversation with a customer. After a quick search, I couldn't find any clear answers. Plus, I knew that manually going through them would likely lead to mistakes.

That's when I thought, why not give GPT-4 a shot to create a Python script that could process those logs for me?

It took a few tries – about 6 or 7 iterations – which included creating a proof of concept to see if I could actually run the GPT-generated code, figuring out why the file wouldn't open, and asking GPT-4 to correct a blatant error. After 11 attempts, I finally got results that I could copy and paste into an email for the customer. In total, I spent around an hour hacking away, learning, and enjoying myself.

Now, let's be clear. I left my last full-time programming gig nearly 20 years ago and didn't write a single line of code for the following 15 years. Over the past 5 years, I've dabbled in Python a bit, writing maybe less than 1000 lines, but I never really dove into it.

Still, I know a thing or two about data structures and can debug and trace a program when needed. This knowledge really helped when it came to understanding how the log data was represented under the hood and figuring out what instructions to give GPT-4.

The end product is a pretty idiomatic Python script that I can – for the most part – wrap my head around. I'd never have been able to write it myself using my old method of hunting for code snippets on #stackoverflow.

GPT-4 doesn't turn me into a software engineer capable of churning out production-quality code. 

As I've said time and again, the current state of LLM is like having an army of budget-friendly interns. You still need to lead them effectively if you want to see any real value.

Full disclosure - writing of this post was also heavily assisted by GPT-4 😎 

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

I know it is a bit late to write about the Mother's Day, but my mom came to town, and we went to see places on the weekend. 😎 

It was such a refreshing thing to reconnect with family, to share those smiles and stories that only we can understand. 

After all, no matter how far we venture, our roots and the warmth of familial love remain our true north star. 🌟 

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Admittedly, this is a clear case of self-promotion! 

In Vulners – Security Intelligence Data Feed, we provide access to Cybersecurity and Infrastructure Security Agency #KEV #vulnerabilities, #ExploitDB, Packet Storm Security feeds, and 10+ other exploit data sources. 

These are all normalized and interlinked, and available in both human- and machine-readable formats.

Please consider browsing through our search feature, which aggregates bulletins from all exploit data sources in addition to CISA KEV:

https://lnkd.in/dr6M8_h7

Alternatively, you may wish to explore CVEs that have indications of being exploited in the wild - all with #CVSS and #EPSS if those are available. Navigate to #CVE details to see information from relevant sources:

https://lnkd.in/daXHrava

Disclaimer. Accessing these searches and most of the data via a web browser does not require an account. However, API access does require an account, typically necessitating a commercial license.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

CISO @ Lightspin | Invented #SecDataOps | Author of ElectricEye | Board Advisor | Staying Dangerous

I'm very excited seeing all the context around risk-based (well. contextualized) vulnerability management and #SecDataOps. The easiest, low effort thing you can do today, is just comparing your feed of vulns to the CISA KEV.

I'm critical of CISA, and a lot of government organizations, but you'd be hard pressed to find an easier to utilize source of actionable intelligence anywhere. The next closest is the ExploitDB feed into NIST but you need to scrape it. Same for PacketStorm and other places.

This is the time I wish LinkedIn offered support for Markdown.

Getting the list of CVEs for comparison is stupid simple, less than 10 lines of Python to get it. Then another few lines to check if your CVEs, no matter the source, are exploitable.

import requests
import json

def get_cisa_kev():
    url = "https://lnkd.in/eFNUMHX4"
    rawKev = json.loads(requests.get(url).text)["vulnerabilities"]
    kevCves = [cve["cveID"] for cve in rawKev]
    return kevCves

Wow, that looks stupid. Here's a PNG

Seriously though - if you're using Oracle VSS, Amazon Inspector, Trivy, Grype, Defender for Endpoint (who has a KEV integration but doesn't refresh it daily from what I've seen), or whatever - it's a pretty easy lookup against it.

Stay Dangerous

#python 

To all #cybersecurity Jedi knights out there - #maythe4thbewithyou 😎 

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

More insights from the audience analysis, this one inspired by another great piece by Richard Stiennon.

https://lnkd.in/dcQfEzty

Here are the top-10 companies on the Vulners – Security Intelligence Data Feed website with hundreds of visitors each as tracked by LinkedIn.

I bet at least for IBM, Deloitte, Accenture, and EY this steams from their MSSP businesses.

I'm not sure what to think about Microsoft, Amazon Web Services (AWS), and Oracle.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

graphical user interface, text, application

This post by Wade Baker, PhD is causing a stir in my feed. The referenced report is an absolute gem, hands down the best thing on #vulnerabilitymanagement I've seen.

But here's the kicker: the report and data are from way back in 2018. Both #CVSS and #EPSS have moved on since then.

Still, I'm willing to bet that most of the conclusions would hold up even with updated data.

Yet, it would be interesting to examine the trends in the exploitation of disclosed and undisclosed #vulnerabilities over the past five years since the report's publication.

Let's face it: when it comes to vulnerabilities management, it's all about #exploitation. That's the only thing that truly matters.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Cybersecurity Researcher, Entrepreneur, Professor

Did you know that following the advice of several security standards to remediate all vulnerabilities with a CVSS score of 7 or above would barely address half of those known to be exploited and almost 70% of that effort would be wasted on things that don't represent real risk right now?

Seem impossible to believe? Check our math in Prioritization to Prediction, Volume 1: https://lnkd.in/eyKzzX25

***
Coverage measures the completeness of remediation. Of all vulnerabilities that should be remediated, what percentage was correctly identified for remediation?

Efficiency measures the precision of remediation. Of all vulnerabilities identified for remediation, what percentage should have been remediated?

#vulnerabilitymanagement #vulnerabilityassessment #cybersecurity #vulnerabilities #cvss #cve

According to the test results in Table 2, a prioritization strategy of “remediate all CVEs with CVSS 7 or higher” would achieve coverage of 53.2% with an efficiency of 31.5%. This turns out to be the best balance among CVSS-based prioritization strategies. Even so, this would still result in needlessly addressing over 25,000 CVEs. Strategies based on CVSS scores of 8 or more perform no better than random chance, from an efficiency and coverage standpoint.

Looking to enhance your #vulnerabilitymanagement approach? 

Learn how the Exploit Prediction Scoring System (#EPSS) can complement #CVSS in prioritizing remediation efforts for better security outcomes. 

🛡️ Check out this article from Vulners – Security Intelligence Data Feed.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

View company: Vulners – Security Intelligence Data Feed

Vulnerability management is a crucial #cybersecurity process for organizations seeking to maintain a strong security posture. 

To efficiently allocate resources and minimize the risk of #cyberattacks, #malware, or other #threats, companies must identify and prioritize #vulnerabilities. 

Although the Common Vulnerability Scoring System (CVSS) is extensively employed for evaluating vulnerability severity, it has its shortcomings. 

This article delves into the fundamental concepts of the Exploit Prediction Scoring System (EPSS) and demonstrates how it can assist organizations in more effectively prioritizing vulnerability remediation efforts.

https://lnkd.in/dAtYSUM8

#vulnerabilityassessment #vulnerabilitymanagement #informationsecurity 

This image clearly illustrates that relying solely on #CVSS and #EPSS isn't enough to make well-informed, risk-based #vulnerabilitymanagement decisions.

In this situation, my greatest concern would be the high-impact #vulnerabilities, as determined by CVSS, that slip through the cracks of EPSS (with an exploitation probability under 5%).

Of course, the specific nature of the assets impacted by any of these vulnerabilities plays a major role in the decision-making process.

But striking the right balance can be quite difficult.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Cybersecurity Leader - Unified Vulnerability Management

View Patrick Garrity 👾🛹💙’s profile

When it comes to vulnerability management, security teams face a daunting challenge: 

How to identify the vulnerabilities that pose the greatest #risk and prioritize them for remediation. For the last decade, most organizations relied on the Common Vulnerability Scoring System (#CVSS) to rank vulnerabilities by severity and still do. However, the exponential growth of vulnerabilities and exploitation in recent years has made this approach increasingly ineffective.

1️⃣  One of the core issues with using CVSS for prioritization is that it only considers the technical severity of a vulnerability, not risk, which often results in an overwhelming number of vulnerabilities to remediate. Furthermore, most of these vulnerabilities will likely never be exploited, making it difficult to know where to focus remediation efforts. As a result, many organizations feel like they are stuck in "vulnerability purgatory" with an unattainable backlog of vulnerabilities to address.

2️⃣ To address this challenge, alternative vulnerability prioritization methods have emerged that use vulnerability intelligence feeds such as Mandiant (now part of Google Cloud), Cybersecurity and Infrastructure Security Agency #KEV and FIRST's Exploit Prediction Scoring System (#EPSS) to identify high-risk vulnerabilities. These methods consider factors such as active exploitation, confirmed exploitation, and the probability of exploitation over the next 30 days. 

3️⃣ To better understand how these different prioritization methods work, let's examine three of the most common methods: CISA's Known Exploited Vulnerability catalog, CVSS Base Score, and EPPS Probability of Exploitation. CISA's catalog provides a list of vulnerabilities that have been identified and confirmed to have been exploited in the wild. This list currently contains 925 vulnerabilities as of April. In contrast, CVSS ranks vulnerabilities on a scale of 0-10 based solely on technical severity. Organizations typically prioritize "critical" and "high" vulnerabilities, which are defined as having a CVSS score of 7 or higher. EPSS is a newer scoring methodology that prioritizes vulnerabilities based on their probability of exploitation over the next 30 days.

4️⃣ To illustrate the differences between these methods, we mapped CVSS and EPSS to the CISA KEV catalog of exploited vulnerabilities using the Nucleus Security CISA KEV enrichment dashboard. This exercise revealed that each prioritization method provides a unique perspective on which vulnerabilities should be remediated, emphasizing the importance of considering how vulnerability intelligence can be used. Using higher EPSS thresholds for instance is a good way to identify high risk vulnerabilities that haven’t been added to the #CISA KEV yet. It could also be useful in prioritizing the most critical exploited vulnerabilities if you have a pile of them.

#informationsecurity #riskmanagement #cybersecurity #security #intelligence #infosecurity #security #datasecurity 

Albert E. Whale - Cybersecurity / Zero Trust

Good take on the new hype. 😎

However, this seems to be an eternal problem - they were looking for #java programmers with 5 years of experience back in 1997 for real.

Indeed, tech's hunger for experience often beats time itself. 

Here's to taming the time-traveling expectations in an ever-evolving digital realm! 🍻 🍻 🍻 

#experience #tech 

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Early morning funny:  

Also it is entry level and requires a CISSP and a Masters in Data Science.

graphical user interface, text, application, email

I'm enjoying this piece by Ross Haleliuk. Plenty of these statements, like the one below, hit the mark.

“It is common for security founders to spend a substantial amount of time in their segment before starting a company.”

I never tire of saying that this is the case for Vulners – Security Intelligence Data Feed, too.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Running angel syndicate for cybersecurity practitioners 👉🏻 visangels.com | Writing about cybersecurity 👉🏻 ventureinsecurity.net | Product & PLG Advisor | Angel Investor | Head of Product @ LimaCharlie

- The "wisdom" that 9 out of 10 startups fail isn't quite true in cybersecurity. 
- From the outside, failure of a security company often looks like success. 
- Most cyber startups will never go public, and many are better off selling early. 

Learn more about success and failure in cybersecurity in the new Venture in Security deep dive. 

https://lnkd.in/gNjtNfYV

#cybersecurity #startups #founders #security 

Open article: On a hunt for successful cybersecurity startups and unicorn founders by ventureinsecurity.net

On a hunt for successful cybersecurity startups and unicorn founders

Ever reached a goal and just wanted to coast? That's complacency creeping in. Get comfortable with discomfort! 
 
The world doesn't pause, and before you know it, you're flung from your comfort zone, thrust into survival mode instead of navigating healthy challenges. 
 
I've been there - stuck in a job too long, stalled on moving until every box was checked. 
 
Shaking up my cozy status quo? That unleashed energy, excitement, passion, and yes, discomfort from the need to conquer new challenges. 
 
Don't get stuck in comfort's lull. Ignite your energy. Embrace the uncomfortable. 😎 
 
----------------------    
🔶 I am Andrey.    
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.    
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.    
    
Liked this post? Want to see more?    
🔔 Ring the bell on my profile    
🔄 Connect with me

Artificial Intelligence is the new Machine Learning. Artificial General Intelligence is the new Artificial Intelligence.

#machinelearning #artificialintelligence 
----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Quite insightful - exploitable #vulnerabilities on your assets must be patched fast!

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Revolutionizing Vulnerability Management at Nucleus 🌐🔐 | Dir. of Strategic Initiatives | Empowering CISOs & Cyber Leaders at Global 2000 to Reduce Breach Risk | 🎤 Speaker at Industry Events

⏰ In just 1 minute (7:05-8:05) of this video from #RSA2023, Kevin Mandia, CEO of Mandiant (now part of Google Cloud), shares a fascinating timeline of initial access in cybersecurity incidents in the United States:

🕰️ '93-'98: Publicly available exploits on vulnerable services
🎣 '98-'02: Shift to phishing
🎯 '02-'19: Spear phishing
🔓 '19-today: 31.8% of initial access is from a vulnerability (1 or 2-day)

This change calls for a new defense strategy, putting patch management (and thus vulnerability management) back on top 🔝

🎥 Video: https://lnkd.in/eFkdgkbW

(Shoutout to Matthew Rosenquist for sharing! 🙌)

#CyberSecurity #CISO #Mandiant #VulnerabilityManagement #Phishing #SpearPhishing

Presenter: Kevin Mandia, Mandiant CEO, Google Cloud 2022 was a year of both conflict and macro-economic pressures that fostered innovation and evolution of cyber attacks. In this keynote, Kevin Mandia will share stories from responding to hundreds of...

Open video: The State of Cybersecurity – Year in Review on youtube.com

The State of Cybersecurity – Year in Review

Damn, it's freaking 117 pages long - with just a paragraph for each term and a table of contents. 😱 😱 😱 

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

🎯 Your vCISO & Auditor | ISO27001 | 💭 Cloudsecurity | Compliance | We automate your information security, you focus on your business 🚀

117 pages of Cybersecurity Terms

From A like Access Control List (ACL) to Zero Trust

Thanks to George M. and Reza Rafati for sharing.

You can also access online: https://lnkd.in/e4KJ2GNr

P.S.: Is any term messing?

#cybersecurity #summary #simple #infosec

2023 Cybersecurity Terms Summary.pdf

Did the genesis of your #SaaS product stem from a personal need or problem you experienced?

That was definitely the case for Vulners – Security Intelligence Data Feed.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Brian Blakley, interesting analogy.

In my conversations with customers, I often hear that their #vulnerabilitymanagement efforts are informed and shaped by #penetrationtesting results.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me

Executive Leadership, Advisor - CISSP, CISM, CISA, CRISC, CDPSE, C-CISO, CMMC-RP

Vulnerability Scan ≠ Penetration Test

Why?

Think of it this way…

A vulnerability scan is like a basic security inspection of your home. 

In this inspection, you walk around the house, checking for – 
-unlocked doors,
-open windows,
-and any visible signs of potential security weaknesses. 

You might notice some obvious issues, like a broken lock or a gap in the fence, but you won't be testing the effectiveness of the security measures in place or trying to exploit them.

On the other hand, a penetration test is like hiring a professional locksmith to attempt to break into your house to test the effectiveness of your security measures. 

The locksmith acts like a burglar, using their skills and expertise to exploit any vulnerabilities they can find. 

They might –
-pick locks,
-climb over fences, 
-or pretend to be a utility worker (social engineering) to gain access. 

The goal is to identify vulnerabilities that a real attacker might exploit and provide recommendations to improve your home security.

In the cybersecurity context, a vulnerability scan is an automated process that identifies known security weaknesses in your IT systems and infrastructure…

...while a penetration test is a more in-depth, manual process performed by skilled professionals who simulate a real attack to exploit vulnerabilities and assess the overall security posture of the organization. 

Both vulnerability scans and penetration tests are essential components of a comprehensive cybersecurity strategy.

Vulnerability Scan ≠ Penetration Test

#CISO #cybersecurity #informationsecurity #riskmanagement

At Vulners – Security Intelligence Data Feed, I think we just about to agree with all three points.

Just ask yourself what would be your lead time to properly react when a new #log4j like vulnerability discovered.

----------------------   
🔶 I am Andrey.   
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.   
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.   
   
Liked this post? Want to see more?   
🔔 Ring the bell on my profile   
🔄 Connect with me


Top 3 Key Takeaways From My Conversations with Security Leaders at RSA 2023 🌐

1️⃣ Vulnerability management remains a significant challenge for even the largest enterprises and government organizations. It's a universal pain point that security leaders see as urgent.

2️⃣ Handling the overwhelming volume of vuln data from scanners is a core issue. Specialized tools are crucial for consolidating, correlating, and analyzing this information to enable efficient and informed remediation decisions.

3️⃣ Vulnerability intelligence is a game-changer for prioritization at scale. Identifying and remediating the most severe vulns being actively exploited in the wild allows organizations to act with speed and precision.

#CISO #CybersecurityLeaders #VulnerabilityManagement #RSA2023

Those who teach you to embrace failure are failing you! 
 
You don't fail until you've given up. 
 
So, it's not failure that teaches you adaptability, resilience, creativity, and so on. 
 
Actually, pushing forward teaches you all these skills and more. 
 
----------------------    
🔶 I am Andrey.    
🔶 Helping #cybersecurity pros get zero false-positive #vulnerabilityassessment.    
🔶 Open to sharing experience on how to use LinkedIn for anything else beyond selling advice on selling advice on LinkedIn.    
    
Liked this post? Want to see more?    
🔔 Ring the bell on my profile    
🔄 Connect with me

Taplio

Andrey Lukashenkov's Linkedin Analytics

Andrey Lukashenkov

What is Andrey talking about?

Who is engaging with Andrey

Andrey Lukashenkov's Best Posts (last 30 days)

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Andrey Lukashenkov's Linkedin Analytics

Andrey Lukashenkov

What is Andrey talking about?

Who is engaging with Andrey

Andrey Lukashenkov's Best Posts .css-qqfgvy{font-size:var(--chakra-fontSizes-md);}(last 30 days)

Want to drive more opportunities from LinkedIn?

Andrey Lukashenkov's Linkedin Analytics

Andrey Lukashenkov's Best Posts (last 30 days)