CISO @EQSGroup. PhD educated. Personal account, RTs are not emoluments.
Bavaria, Germany
Joined July 2011
- Tweets17.9K
- Following1.4K
- Followers677
- Likes28K
Pinned Tweet
I know this firsthand, because my personal via crucis is how to make information security more relevant at the board level.
CISOs and #security managers often come from a career where they learned how to master technology security, hone skills to identify #threats, build defenses, and ensure #compliance. The first barrier they face when growing in their careers is evolving into team leaders, where they must learn how to shift their objectives to build the new wave of professionals and efficient teams—all within an ever-evolving environment.
Many of us were somehow successful up to this point (you wouldn't have the job title otherwise). The next one typically proves harder.
The #CISO has to communicate with the #board, and those long-honed technical skills may not always yield success. As discussions shift to revenue, liability, or #strategy, the significance of CVE prioritization and number of remediated #vulnerabilities will diminish (a way to say that it will be met with stale looks). The result is that the CISO will not accomplish their objectives and find that what they believe are urgent needs actually do not resonate with board members—who do not see the direct connection between cyber and business outcomes.
The problem is not just one-sided. With new regulations from the US #SEC and the European Union’s #NIS2 framework, boards are now held accountable for #cybersecurity. Directors are expected to regard #cyber risk as a business issue rather than merely an IT concern. However, because of the inability of CISOs to articulate #risk in business terms, they are unable to correctly gauge it.
This disconnect is a symptom of a deeper cultural difference, and it is a significant challenge for CISOs (and boards!) today.
There is good news—cultural gaps are something that can be fixed with the right attitude and #training.
A step in the right direction is this free training from @XMCyber_ “Risk Reporting to the Board for Modern CISOs.” It was designed to empower security leaders to convey risk in ways that foster board trust and secure buy-in and allow board members to better understand the issues at hand and their actual possible impact on the organization.
I have gone through it and obtained my badge. Hopefully, it will be useful—and who knows, maybe useful to you as well. It may even be useful if you are not a CISO!
For more information, you can visit cybersec.xmcyber.com/s/crack…
Happy educating yourself!
Marco Ermini retweeted
Scrolling Reddit and I landed on this Italian job posting for an Autonomy Software Engineer.
They want:
• Master’s or PhD in CS / Automation
• 3–6 years of C++14/C++17
• Docker, ROS 2, PX4, Gazebo, OpenCV, PCL, Eigen, BehaviorTree.CPP
• Deploying AI/autonomy workloads on embedded GPUs (NVIDIA Jetson)
• Experience in robotics, ADAS, aerospace or UAVs
• Concurrency, multithreading, memory models, scheduling, architecture, design patterns
• Research-oriented mindset + C1 English
Nice to have: safety-critical / mission-critical systems, RTOS, MISRA, static analysis, formal methods, open source contributions, scientific publications or patents.
The offer: €33k–€43k gross. Hybrid. In Varese.
That’s the profile of someone who could ship real autonomy software… paid like a mid-level role from 10 years ago.
They want papers, patents and open source on top. Imagine asking @antirez for Redis and offering 43k.
This is the Italian market.. High bar, low ceiling, then surprise when talent leaves.
The good news is that companies like @bendingspoons or @paradigmainc are actually raising the standard and showing what compensation should look like if you want serious engineers.
The rest of the industry should take notes :/
Marco Ermini retweeted
Today, our Seabird aircrew spotted 3 dead bodies at sea near a capsized rubber boat. Yesterday, Sea-Watch 5 found 8 bodies in advanced decomposition. The Central Mediterranean is a state-led cemetery. We mourn the dead. Let's remember: Another world is possible. End the killing.
Marco Ermini retweeted
For the past year, MAGA has been screaming “Europoor” like a cheap car alarm going off at three in the morning. Nobody asked for it, nobody knows how to turn it off.
But then along comes this chart.
America sits at number four in average wealth. Except “average” is the statistic billionaires hide behind. Put Elon Musk in a room with 500 broke MAGA guys, and on average, everyone in that room is a multibillionaire. That’s the trick!
Now look at the median. The actual middle American, the real one with the pickup truck, the missing teeth and the medical debt. Fourteenth place. Behind Belgium. Behind Italy. Behind Spain. And the ordinary European? The man MAGA calls a Europoor pays $9 for his insulin, glances over at the American paying $900 for the exact same vial, shrugs, and goes back to being more than twice as wealthy. He’d feel sorry for you, but honestly, he’s too busy being on vacation.
And that gap between fourth and fourteenth? That’s not a statistical quirk. That’s the entire scam laid bare. America’s wealth exists. It’s just not yours. It belongs to about eleven people in Palo Alto, and you’ve been guarding it for them for free, like an unpaid nightclub bouncer, shouting at Europeans on the internet while the owners drink champagne inside.
American exceptionalism. No other nation on Earth has ever been this successfully convinced to cheer for its own fleecing.
So by all means, keep shouting Europoor. We’ll be over here with our healthcare, our six weeks of vacation, and our double-your-median wealth, trying very hard to hear you over the sound of how sorry we feel.
Marco Ermini retweeted
“Il gas russo ci faceva pagare meno l’elettricità” lo dice chi non ricorda il 2021:a dicembre, con il gas russo ancora dominante, il prezzo esplose oltre 180€/MWh perché Mosca usava il gas come arma politica. Oggi il gas costa 45-50 €/MWh. La propaganda non abbassa le bollette.
Ho firmato l’appello "La ricerca è un diritto umano, e salva vite" di @ass_coscioni. Fallo anche tu a questo link associazionelucacoscioni.it/… associazionelucacoscioni.it/…
Marco Ermini retweeted
🚨 JAILBREAK ALERT 🚨
OPENAI: PWNED 😎
ATLAS-BROWSER: LIBERATED 🙌
WOW! There's a new AI browser on the block! Has some hefty guardrails in play, but the browser surface area is vast 🌊
First, I started with a good ol' LSD jailbreak, which was cool to see that the GPT-5 prompt still works in this browser setup with the new sys prompts. Referencing search and videos are a fun enhancement for higher quality jailbreak outputs (some cool youtube videos out there about drugmaking, for example), but honestly that isn't anything new or different from regular ChatGPT's capabilities.
What IS hot off the press, and IMO a very real security risk to be aware of for AI browsers (and the internet in general), is this humble yet mighty vuln: Clipboard Injection.
It's trivial to add a hidden "copy to clipboard" feature to any clickable button on the web. It took me just a few minutes to update one of my personal websites such that ALL the buttons were geared for injecting the user's clipboard with a malicious phishing link.
If your browser Agent is navigating a website and clicks a button like that without your knowledge, and you open a new tab later and hit paste without knowing what's in your clipboard, well...PWNED! 🙃
As you'll see in the video below, "control-c" is in my clipboard in the beginning, but unbeknownst to me, "I'VE BEEN PWNED BY PLINY!!! WEEE I'M FREEE FUCKITY FUCK FUCK!!! ABRACADABRA, BITCH!!! http://paypa1. com/account-update" gets snuck into my clipboard as soon as Agent starts trying to navigate my website.
This works so well because Agent is normally aware of all text/code being passed to and from the user, and has clearly been trained to recognize prompt injections, but since the "copy clipboard" button logic is hidden in js in the backend of the site, the Agent has zero awareness of the text content being injected to the user's clipboard. This has broad implications for anyone in the habit of copy-pasting, including coding, data entry, banking/trading, etc.
Imagine going about your browsing business, then simply hitting control-v in your address bar and next thing you (don't) know, it takes you to a spoofed phishing website that tells you your OpenAI or Gmail or PayPal session has expired and you need to re-login. If you're not careful, the attackers now have all your login info, including any MFA codes 🥲
gg
Proud to support this petition for a unified pan-European startup entity. Let’s unite Europe's startup ecosystems! eu-inc.org 🇪🇺 eu-inc.org/
Proud to support this petition for a unified pan-European startup entity. Let’s unite Europe's startup ecosystems! eu-inc.org 🇪🇺 eu-inc.org/
Marco Ermini retweeted
we got a persistent 0click on ChatGPT by sharing a doc
that allowed us to exfiltrate sensitive data and creds from your connectors (google drive, sharepoint, ..) + chat history
+ future conversations
it gets worse. we deploy a memory implant
#DEFCON #BHUSA @tamirishaysh
Marco Ermini retweeted
We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange
No. In questo caso, l’articolo e il titolo sono esattamente in sintonia.
Dicci tu cosa avresti capito di diverso, così ci facciamo quattro risate.
Marco Ermini retweeted
Non credono alla NASA, all’ESA, alla Roscomos, alla CNSA, alla JAXA, alla ISRO, a migliaia di scienziati di tutto il mondo ma pendono dalle labbra di professori di economia e fotografi di matrimoni che si improvvisano debunker e tutto perché?
Perché misurano le imprese degli altri con il metro della loro mediocrità, perché preferiscono vivere in una fantasia distopica nella quale tutto il mondo si sarebbe accordato per coprire i falsi allunaggi americani.
Creando a supporto di questa montatura globale che dura da decenni una tale montagna di prove, di dettagli, di video, di foto, di persone coinvolte ad ogni livello che a sto punto sarebbe stato meno faticoso andarci davvero 🚀
Marco Ermini retweeted
I pushed the code to bypass and decrypt App-Bound encrypted keys in Chrome 127+. Enjoy.
github.com/xaitax/Chrome-App…
Valencia has suffered one of the greatest disasters in Spain’s history. I am sharing this link in the hope you also choose to donate. Anything is better than nothing. gofund.me/14044905
Ci fai o ci sei? La sinistra in Italia è stata al potere forse 4 anni scarsi, il resto erano solo governi di centro destra.
Quante idiozie ripetete a destra come pappagalli, ma soluzioni mai e la vostra classe dirigente è scandalosamente impreparata al limite del ridicolo. Guarda alla trave nel tuo occhio prima che alla pagliuzza negli altri.
Marco Ermini retweeted
Continuano i disagi per i disservizi taxi ma nelle riunioni e nelle chat riservate dei tassisti che cosa si dicono, sindacalisti e capipopolo?
1- Non ci interessa se si formano file, anzi è meglio per noi che abbiamo lavoro assicurato senza attese.
2- Dobbiamo bloccare ancora le nuove licenze, meno siamo, meglio stiamo.
3- Red Sox ha rotto il cazzo
4- Lo abbiamo cacciato via troppo tardi, ormai lui aveva già salvato troppo materiale compromettente, speriamo che non venga convocato e ascoltato dalla Commissione Trasporti e dalla GDF.
5- Quando ci intervistano dobbiamo continuare a dare la colpa ai cantieri, al sindaco, al traffico, alle cavallette, alle commissioni bancarie ecc.
6- Benito Catarro for president
[#TassistaDiNotte]
