
CEO, SideChannel @SideChannelSec $SDCH | @RealCISO | Author | #CISOlife
Boston area
Joined May 2011
- Tweets7.6K
- Following445
- Followers919
- Likes11.1K
Brian Haugli retweeted
🚨 JUST IN: By stroke of pen and flanked by Cabinet members, President Trump just signed an executive order directing every federal agency in the United States to IMMEDIATELY begin combining into America .gov — a Super Intelligence-powered page letting Americans complete every interaction with the federal government in ONE SEARCH, ONE FORM
NO MORE going to multiple agency sites and looking at DOZENS of different pages to accomplish one thing.
THIS IS HUGE!
Many Americans are about to have HOURS freed up 🇺🇸
Another great Fan Expo in Boston. Thanks for the quick chat @SeanAstin & @BillyBoydActor
#fanexpohq #fanexpoboston @FANEXPOBoston
1
1
287
And shout out to @deanjnorris for talking to us too! Sorry to scare you.
61
Brian Haugli retweeted
Jocko Willink says he broke a 30 second freeze on a 1990s SEAL training exercise by taking one 12 inch step, and it showed him the call four senior leaders could not see.
"And by the way, I'm the youngest and most junior guy in my platoon, and I'm standing there looking down the sight of my weapon."
"And I'm waiting for someone to make a call and tell us what to do."
"And I wait for five seconds and I wait for 10 seconds and I wait for 20 seconds and no one's saying anything."
"And we're waiting for a leader in my platoon to make a call to tell us what to do. Tell me what to do."
"And finally, after like 30 seconds, which seems like an eternity, I can't take it anymore."
"And so I take a step, like a... one foot step, 12 inches. I take a step off the skirmish line."
"I look to my left. I look to my right. And what I see is every other guy in my platoon is staring down their weapon, staring down the sight of their weapon, which means their field of view is tiny."
"It's like a 20 degree field of view."
"There's my platoon commander... there's my platoon chief... there's my leading petty officer... there's my assistant platoon commander... so everyone in the platoon is looking down the sight of their weapon, which means they all have a very narrow field of vision."
"Well, when I take a step back and look to my left and look to my right, guess what kind of field of vision I got? I got a massive one."
"I can see the whole scene and I can see exactly what it is we need to do."
Four experienced leaders were standing in that line looking at the same problem, and not one of them was short on skill or nerve. They were looking down the same narrow tube he was, and by his account the answer was sitting outside it the whole time.
I think about that whenever I am stuck and certain the problem is that I do not know enough yet. Usually I know plenty. I have just been reading the same thread for twenty minutes, or turning the same argument over on the same walk, from the exact spot I was standing in when it started. Jocko was the most junior man on that line and he still saw it first, because he was the only one who moved.
- Jocko Willink (@jockowillink) on Huberman Lab (@hubermanlab)
Brian Haugli retweeted
The best military in the world meets the best business talent in the world.
At @DeptofWar we’re harnessing top private-sector talent to equip our warriors for the future fight.
Join us 👉 BOND@WAR.MIL
When trains hit people on the tracks outside a crossing or it's a suicide by train, the dead are referred to as "trespassers".
Unfortunately, was on an Amtrak when than happend. – at Boylston, MA
Late last night, a trespasser breached airport security at Denver Int’l Airport, deliberately scaled a perimeter fence, and ran out onto a runway.
The trespasser on the runway was then struck by Frontier Airlines Flight 4345 during takeoff at high speed. The pilot stopped takeoff procedures immediately.
The Frontier plane was then quickly evacuated while law enforcement and firefighters responded.
Preliminary reports are 12 people were hurt, with 5 taken to the hospital.
Local law enforcement handles airport security and is investigating with support from the @FAANews and TSA.
No one should EVER trespass on an airport.
2
453
Managing cybersecurity programs for clients isn't just a security problem; it's a scale problem. @RealCISO is designed to help you grow. – at Boylston, MA
125
The Hon. Kirsten Davies drove home the sense of urgency she feels to make lasting change for the Warfighter and the nation. This is “not business as usual,” as significant changes are underway in how the @DeptofWar develops IT and cyber tools. Under the leadership of @POTUS and @SecWar Hegseth, we have an unprecedented opportunity to transform the Department. The DoW CIO is moving at lightspeed to empower our warfighters and partners, building a true Arsenal of Freedom for the digital age.
#CyberSecurity #DigitalTransformation #Innovation #DoW #ZeroTrust
1/ Anthropic's Project Glasswing results are out. Claude Mythos Preview found thousands of real zero-days across major OSes, browsers, and critical infrastructure — autonomously, without human intervention.
The numbers are not small.
1
119
2/ 181 working Firefox exploits vs 2 for the previous model. A 16-year-old FFmpeg bug missed by 5 million automated fuzzing runs. A 27-year-old OpenBSD TCP vulnerability.
These are production systems running right now.
1
88
3/ What this means for security teams: your patch cycle is too slow, your disclosure assumptions are outdated, and defenders who move first win.
Full breakdown — including Anthropic's new Cyber Verification Program for practitioners: sidechannel.com/blog/anthrop…
58
Crowdstrike's listed, not SentinelOne...
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
anthropic.com/glasswing
1
211
I'm new to LLM, but feel excited about the speed I've picked up how to use it for myself. Between this and his autoreseach, I'm hooked.
I co-authored a book on NIST CSF and luckily own the copyright. I've created a skill in Claude that knows its content cold. Through autoresearch it's perfect in how it answers my questions, provided content, and able to make sure my own writing is in line with what I wrote in that book.
Creating a personal knowledge base for a LLM is, for me, the next level of being able to operate as an expert in an area. Excited about the future here. – at Boylston, MA
LLM Knowledge Bases
Something I'm finding very useful recently: using LLMs to build personal knowledge bases for various topics of research interest. In this way, a large fraction of my recent token throughput is going less into manipulating code, and more into manipulating knowledge (stored as markdown and images). The latest LLMs are quite good at it. So:
Data ingest:
I index source documents (articles, papers, repos, datasets, images, etc.) into a raw/ directory, then I use an LLM to incrementally "compile" a wiki, which is just a collection of .md files in a directory structure. The wiki includes summaries of all the data in raw/, backlinks, and then it categorizes data into concepts, writes articles for them, and links them all. To convert web articles into .md files I like to use the Obsidian Web Clipper extension, and then I also use a hotkey to download all the related images to local so that my LLM can easily reference them.
IDE:
I use Obsidian as the IDE "frontend" where I can view the raw data, the the compiled wiki, and the derived visualizations. Important to note that the LLM writes and maintains all of the data of the wiki, I rarely touch it directly. I've played with a few Obsidian plugins to render and view data in other ways (e.g. Marp for slides).
Q&A:
Where things get interesting is that once your wiki is big enough (e.g. mine on some recent research is ~100 articles and ~400K words), you can ask your LLM agent all kinds of complex questions against the wiki, and it will go off, research the answers, etc. I thought I had to reach for fancy RAG, but the LLM has been pretty good about auto-maintaining index files and brief summaries of all the documents and it reads all the important related data fairly easily at this ~small scale.
Output:
Instead of getting answers in text/terminal, I like to have it render markdown files for me, or slide shows (Marp format), or matplotlib images, all of which I then view again in Obsidian. You can imagine many other visual output formats depending on the query. Often, I end up "filing" the outputs back into the wiki to enhance it for further queries. So my own explorations and queries always "add up" in the knowledge base.
Linting:
I've run some LLM "health checks" over the wiki to e.g. find inconsistent data, impute missing data (with web searchers), find interesting connections for new article candidates, etc., to incrementally clean up the wiki and enhance its overall data integrity. The LLMs are quite good at suggesting further questions to ask and look into.
Extra tools:
I find myself developing additional tools to process the data, e.g. I vibe coded a small and naive search engine over the wiki, which I both use directly (in a web ui), but more often I want to hand it off to an LLM via CLI as a tool for larger queries.
Further explorations:
As the repo grows, the natural desire is to also think about synthetic data generation + finetuning to have your LLM "know" the data in its weights instead of just context windows.
TLDR: raw data from a given number of sources is collected, then compiled by an LLM into a .md wiki, then operated on by various CLIs by the LLM to do Q&A and to incrementally enhance the wiki, and all of it viewable in Obsidian. You rarely ever write or edit the wiki manually, it's the domain of the LLM. I think there is room here for an incredible new product instead of a hacky collection of scripts.
2
2
213
I'm a believer that building your own agentic twin is a valuable exercise. Especially in Claude CoWork with skills. You get to see if it's right and sound like you in it's outputs. That's only possible if your able to build your guardrails on the skill, folder structure, and claude files.
From here, why not build out a twin of your team? Use it to collaborate or argue on tasks without the time needed or the distraction to the real human. You're able to enter the real life conversation better armed with the approach and most realistic outcomes. – at Boylston, MA
1
85
Not going to cold email all them ourselves, but they need a consultant, tracking platform, and AICPA auditor to get right.
@sidechannelsec is the first 2 and partnered with great auditors. – at Boylston, MA
Ruining my Saturday by asking every Delve customer if they're staying with Delve (based on the claims in the latest video). I already got one reply.
2
2
1,365












