Latio Tech

A trusted resource for cloud & application security product comparisons - opinions are my own and links below:

- Cloud Security List - https://list.latio.tech
- In depth product analysis newsletter - https://latio.beehiiv.com
- YouTube Channel - https://youtube.com/@latiotech
- GitHub Testing Repo - https://github.com/latiotech/insecure-kubernetes-deployments

I receive no financial incentives from any company we feature!

Founder

PagerDuty

Securing the world's operations tools - the right information at the right time can change the world!

- FEDRAMP, FEDRAMP, FEDRAMP!
- AWS, Containers, K8s, SDLC pipelines, and a bunch of other cloud native stuff

Security Engineer III

ReliaQuest

Lead all aspects of product security for GreyMatter, a SaaS security operations platform.

Manage a team of Product Security Engineers to deliver meaningful product improvements such as CSP, RBAC, CSRF protections, and custom scanning logic.

Subject Matter Expert for AWS, Kubernetes, Container, CI/CD, and Code Security.

Lead Threat Modeling Exercises, Developer Training, DevOps Training, and Compliance Attestation requirements (ISO 27001, SOC 2, FEDRAMP, and PCI).

Manage a team of Product Security Engineers to deliver meaningful product improvements such as CSP, RBAC, CSRF protections, and custom scanning logic.

Deploy, develop, and maintain a suite of security tools that enable DevSecOps such as Snyk (SCA, SBOMM, SAST, Container, Cloud, IAC), StackHawk (DAST and GraphQL), GitLab tooling, Sysdig, Prisma Cloud, and many others.

Develop internal cloud security tooling and training using Spotbugs, Cloudquery, OWASP standards and numerous open source projects.

Responsible for the cloud security architecture of over 300 Java SpringBoot MicroServices, running across multiple clouds and clusters. Daily usage of modern DevOps tooling such as Kong, Argo, DataDog, Grafana, and Prometheus.

Responsible for the remediation of hundreds of vulnerabilities, the implementation of modern web security standards, passing SOC 2, PCI, and ISO audits, and successful pentests.

Regular participant in industry thought leadership, sales calls, and customer success initiatives.

Sr. Cloud Security Engineer

Very Good Security

Security architect of Very Good Security Products - compliance automation, data aliasing, secure data processing, and payment multiplexing solutions

Directly managed and collaborated with a team of SME’s across engineering and compliance to maximize the product impact of integrations and framework support

Directly contribute to documentation, technical videos, sales engagements, and feature deployments - both in terms of product guidance and direct development using Ruby, JavaScript, Markdown, Docker, Python, Bash and other technologies.

Develop, maintain, and implement over 200 security automations and monitors across 13 compliance frameworks such as SOC 2, ISO 27001, PCI, HIPAA, NIST and GDPR.

Provide security engineering and architecture guidance for over 100 clients, across most modern clouds, source code control, vulnerability, device management, containerized Kubernetes and security platforms.

Develop 300+ tasks for helping both business and engineering teams achieve compliance and security standards, cross mapping tasks across 13 compliance frameworks and creating monitors for all tasks.

Create and lead combined initiatives across marketing, sales, product, and development teams, bringing major features to market such as quantitative risk management, cloud monitoring, employee onboarding, and new integrations. 

Contributor to numerous open source cloud security projects

Directly maintain and develop implementation guidelines for AWS, GCP, Azure, GSuite, Github, Gitlab, Bitbucket, KnowBe4, BambooHR, Rippling, Gusto, Slack, Jamf, Okta, Jira, Office 365, Azure AD, JumpCloud, Citrix, Snyk, SonarQube, WhiteSource, Kiuwan, Prisma (Twistlock), Splunk, DataDog, Ansible, and more.

DevOps experience contributing to Docker projects and Kubernetes security best practices - from vulnerability scanning with Aquasec to networking with Calico and AWS CNI’s. Contribute to internal security CI/CD security, AppSec and AWS architecture security.

Cloud Security Architect

Responsible for the security of GreyMatter, the world's first open XDR that empowers the full security incident response workflow.

Security implementation and management of IAM, EKS, CI/CD, SAST, DAST, GraphQL API Scanning, SSH, ELK, APM tools, DataDog, Splunk, QRadar, WAF, Palo Alto, Prisma Cloud and everything that goes into securing a modern multi-cloud web platform. 

Implemented proper controls at all phases of the development process: IAM, Kubernetes infrastructure, Gitlab deployment, firewalling and application layer.

Coordination across Dev, DevOps, DevSecOps, Infrastructure, and Security.

Cloud Security Engineer

The Southern Baptist Theological Seminary

Assist Dr. Ted Cabal in creating coursework and grading for Philosophy courses.
Assist Dr. Douglas Blount in grading for Philosophy courses.
Independently teach and manage online courses.

Graduate Teaching Assistant

Spartan Race, Inc.

Led all IT management and support across 42 countries, 250+ annual events, and 400 employees for a company with $100M+ revenue. 

Directly managed a team of three systems engineers responsible for maintaining the health of cloud and on premise environments

Generated $1M+ of annual savings in first year of employment.

Architect of Microsoft stack running in a hybrid cloud - VMWare, AWS, and GCP.

Managed vendor deployments with Apple, CDW, Autodesk, Adobe, Microsoft, VMWare and Google to conduct $2M+ dollars of purchasing a year.

Led successful cyber-security audit and security implementations for financial and healthcare sponsorship deals using NIST and ISO 27001; PCI and HIPAA experience.

GSuite subject matter expert - alpha programs and implementation.

Secured diverse environment of Mac and Windows desktops, laptops, Androids, iPhones, iPads, Kindle Fires, Chromebooks, and Linux machines.

IT Operations Manager

Atlas Professional Services

IT project design and support for over 300 national companies across all sectors

Consultations on hybrid-cloud, colocation, network, security, backup, and data.

Consulted small to medium size businesses on achieving NIST compliance with AWS and on premise data stores.

Demonstrated technical proficiency with the following: Windows Server 2008-2016, Datto, Veeam, Acronis, ESXi 5-6.7, Dell and HP Servers and SANs, various firewalls, switches, and routers, S3, EC2, Citrix, Active Directory, Office 365, GSuite, SQL, Powershell and Connectwise Suite RMM.

Systems Engineer

Security Engineer @ PagerDuty + Founder @ Latio Tech

I have a passion for driving security teams as contributors to product (the true meaning of DevSecOps) and built Latio Tech to help connect people with the right products.

Newsletter is live! "On paper, Lacework had substantially more features than Wiz. They support all the same scanning, plus some, and have had agent based runtime detection for a much longer time. However, all of these features were built around a UX that people didn’t want, namely the idea that every finding should turn into an alert; and over time customers didn’t want more alerts, they wanted less of them. Customer’s don’t go on the market looking acquire sets of features, they go looking to solve problems."

James Berthoty

pulse.latio.tech • 5 min read

A Platform is not a Product

This is how I view the security landscape. Some companies are betting big on use cases, others betting big on end users. With last weeks article, I meant that too many companies are focusing on consolidating acronyms within their own side of the diagram, instead of asking what features need to be aligned to meet the use case.

Some sales tips from a buyer:

1. It sucks, but "We were the first to do this" holds exactly 0 weight in a buying decision. People aren't comparing your platform against other ones 3 years ago, they're doing it now. You might get some market awareness by being early, but it doesn't help win the immediate sale. If you were first and other people have caught up, it ironically makes you look worse for not moving as fast.

2. You're not going to convince a customer they have a problem on a sales call. Your sales strategy can't be convincing a customer that they've missed something critical in their security program that only you've discovered. If someone says, "oh we don't run into that issue," the only thing to ask is what current challenges they do run into. You can't say, "oh well a lot of other people do."

3. In security, scare tactics come across as criticism. Saying, "how are you currently detecting this?" comes across as "how could you be so incompetent that you've left this gap in your visibility?"

4. Every clean and easy SaaS pitch distills to either, "now you don't need to hire someone to do this" or "now you can cancel your subscription to that other tool." You can pitch net new categories, but it's about 10x harder to justify if you can't tie it back to automating someone's necessary manual work.

5. Using or not using any particular technology to achieve your outcome usually doesn't matter to people. I would never try to pitch "we use x whereas other people use y therefore we're better." The big unless here is if you can very clearly connect it to a product outcome, such as "because we use x and not y, we're able to detect this event, or deploy changes like this one much faster than our competitors." Even still, this cannot be your core pitch, but can be a differentiator.

New post is live - RSA Takeaways:

1. ASPM is hard to sell - people are still focusing on point solution replacements

2. Runtime is heating up - eBPF and instrumentation is getting easier to deploy, offering more insights than there's time to build detection for

3. People are discontent with current tools - many people are churning from their first cloud and appsec choices

4. Staying out of Wiz's way - Every high level product decision comes down in some way to competing with Wiz or complimenting them

The full post is here:

pulse.latio.tech • 4 min read

[Latio Pulse #10] RSA Takeaways

As container scanners get better, I'm seeing the necessary convergence of SCA and Container Scanning - the time has come where you don't really need both scanners; BUT only if your container scanner is a really good one (here I'm mostly thinking of Oligo Security and Kodem). 

The main pro and con of container scanning is that it's way more holistic, but the container needs to be built before the scan can happen. It also opens up possibilities for runtime analysis, as well as deeper visibility into what's actually happening with your app.

The main pro and con of SCA scanning is that it can be run pre-build, but it never truly reflects the app at runtime. A downstream effect of this is that you will always need container scanning, but SCA scanning will be optional. This also means more and more duplicate scanning results.

Here are a few logical outcomes of the convergence of SCA and Container Scanning:

1. It makes sense for vendors that rely primarily on container scanning to offer a solution for scanning pre-build - even if it's just watered down SCA that gets super powers from the runtime insights. Most all-in-one ASPM players like OX Security, Cycode | Complete ASPM, Jit.io, Aikido Security, etc. (https://lnkd.in/eu8v2kgY for the full list) offer both for this reason.

2. It increases the importance of vendors like Opus Security, Dazz, DevOcean, or Phoenix Security | ASPM that provide de-duplication of different scanner results.

3. It speaks to why someone would invest in a "better container scanner" and drop SCA + CNAPP container scanners completely. There is a huge opportunity here for Oligo Security and Kodem specifically

4. It seems to me that SCA only vendors need to come up with a solution for runtime reachability or even just visibility, whether it's via partnership (like Snyk + Sysdig) or via deeper analysis of the app trying to create a mirror of what the runtime should look like (like Bionic, Apiiro, or BackSlash)

Two primary market education needs from meeting with vendors and security practitioners at RSA:

1. People are still learning the kinds of AppSec scanning that exist and why you would want them on top of a CNAPP. At this point, it seems most people have at least one SCA and SAST tool, but don't immediately think of the benefits of having more than that in a single consolidated place. 

2. "Shield Right" is becoming more common as a response to overdoing the messaging on "shift left" but there's no clear consensus on what that actually means. There's a ton of rapid innovation happening in this field, and it's very much in the air - from legacy EDR like CrowdStrike and SentinelOne, to modern ones like Sweet Security, to application level ones like Oligo Security or Miggo Security - there is plenty to watch here.

Alright, I've got tons of little self stuff I need to share here that's all stacked up, so I'm doing it a very bad LinkedIn algorithm way and just putting it all right here! But if you want more hot takes, here's where to find them:

Latest podcast episode with Opus Security and Justin Somaini - this was such a helpful conversation about obtaining leadership buy in for vulnerability management: https://lnkd.in/gc_qRaVT

Amazing conversation with Amit B. and Backslash Security in Who Wants to be a Millionaire format - a really fun way to discuss major problems in vuln management and learned a ton. Amit's got developer nerd street cred, so we talked lots of specifics - https://lnkd.in/gPA3bSuU

If you want to know where you can be guaranteed to find me at RSAC, I'll be at the OX Security Wednesday night happy hour. I'm a certified Ox fanboy so I gotta be there, you can register here - https://lnkd.in/gwFnBE7p

Big news I have hot takes on: 

Kodem launches runtime SAST - this has absolutely massive possible ramifications for application security depending on instrumentation - https://lnkd.in/gqkiKZuy

Drata acquires oak9 - I love to see Drata doubling down on the developer angle instead of chasing GRC up to the enterprise. In an age of very dumb acquisitions, this one is really really smart - https://lnkd.in/gewsvfCs

Orca Security and Aqua Security partnership - finally an acknowledgement that the people want a configuration scanner and a runtime tool; however, there's plenty that's awkward about this partnership with a lot of redundant features. It speaks to the market opportunity of a CSPM + Runtime dream, personally I would go ASPM (Ox, Aikido, Cycode, Apiiro, Jit) + K8s protection (Armo, Rad, Upwind, Sweet, Oligo) instead.

Aikido Security Raises a big series A - great job to a great team, Aikido's a really good product. https://lnkd.in/gVct93jx

New video and corny thumbnails are back! This week I was going to use Xygeni to talk about upstream malware detection, but after getting access to their platform I was surprised by how differently they're approaching "ASPM" than everyone else. So in this video we use their product to talk about things like repository health issues, and supply chain attacks I've actually seen in pentests and real life.

Latio Tech List v1.12, changes below:

Added Leen to Boundary Breakers - a unified API for vulnerability data

Added Tracebit to Boundary Breakers - Honeypot infrastructure for your cloud

Added Turbot to Cloud Identity, Secret Scanning, IaC, and CSPM - guard rails and enforcement on top of querying cloud data

Added Cremit to Secrets Scanning - Secrets scanning + real time monitoring

Added Pillar Security to LLM - Library based application detection and protection

Added OpenRefactory, Inc. to SAST - focusing on building an amazing SAST engine above all else

In this week's post, I wanted to give a quick summary and highlight some of the companies in the RSAC Innovation Sandbox. I thought a lot of the picks this year were good ones, and if you're looking to level up a piece of your security program, all of these vendors are solving real major problems for people.

I highlight the problem space, what makes them unique, and the biggest objection for:

Aembit - Identity
P0 Security - Identity
Harmonic - Data
Antimatter - Data
RAD Security - Kubernetes
VulnCheck - Vulnerabilities

Read more here:

pulse.latio.tech • 6 min read

RSAC Innovation Sandbox 2024 - Who to Watch

New blog post is live with ARMO! When I started exploring the world of Cloud Detection Response (CDR), I thought I would be over the moon - I've been waiting for runtime security in the cloud to get the focus it deserved. To my surprise, most of the vendors in the space didn't even support kubernetes, and couldn't get meaningful container level visibility!

To me, this was the key issue with CSPM solutions that dabbled in CDR - the kubernetes visibility was never quite up to snuff. In this article, I cover the history of how we got to CDR, and ultimately why Kubernetes runtime lays at the heart of the problem.

armosec.io • 5 min read

What it takes to do Cloud Detection & Response?

One more reason for upstream malware scanning third party dependencies!

https://lnkd.in/eN_WnPXZ


bleepingcomputer.com • 2 min read

Fake job interviews target developers with new Python backdoor

I went back and listened to this conversation I was honored to have with Shaun Blackburn and there is so much gold in here that I'm looking to apply - Shaun has some amazing experience building top notch security teams and we covered a huge amount of topics in such a short amount of time. Some highlights to me were ways to combine your vulnerability management with threat hunting, and the different approaches to vulnerability management depending on your scale & infrastructure.

This was exactly the kind of resource I would've loved to have a few years ago when I was just getting started here, thanks again to Shaun for the time!

opus.security • 1 min read

Working with Engineering on Security

I'm excited for this fun webinar with Amit B. to learn application security together. It's Who Wants to be a Millionaire themed (DevSecMilliOps?) and there's a $250 Amazon gift card on the line - hope you'll join us next Tuesday @1pm EST!

events.actualtechmedia.com • 1 min read

Who wants to be an AppSec-ionaire? Webinar - Presented by ActualTech Media

Quick video this week on how to run nightly docker image rebuilds and why you should do it! This is the easiest first step towards reducing container vulnerabilities and often feels scarier/harder than it is.

What's everyone using for AI TRiSM these days? 

Taplio

James Berthoty's Linkedin Analytics

James Berthoty

James Berthoty's Best Posts (last 30 days)

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}James Berthoty's Linkedin Analytics

James Berthoty

James Berthoty's Best Posts .css-qqfgvy{font-size:var(--chakra-fontSizes-md);}(last 30 days)

Want to drive more opportunities from LinkedIn?

James Berthoty's Linkedin Analytics

James Berthoty's Best Posts (last 30 days)