Mark Johnston retweeted
Very excited to announce Gemini 4 Argon, our new Frontier AI model, and a huge step forward across key capabilities. We’re focused on rolling it out responsibly starting with government and trusted cyber defenders through our Fairwind Program today, before wider availability soon
Mark Johnston retweeted
This is pretty embarrassing 🙈
Microsoft has a signed Defender driver that can be abused to kill Defender/EDR and modify protected files and registry settings
We also can’t really solve this the usual way by adding the driver to the vulnerable driver blocklist. It’s Microsoft’s own Defender component!!
MSRC says it doesn’t require immediate servicing because you already need admin privileges 😏
Which probably means this MS-signed EDR killer will stay usable for a while. Nice 🫶
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026…
Mark Johnston retweeted
"So Is Your #SOC AI-Ready? Part 3: API or Die Audit!" bit.ly/4ztd7yI <- the long-promised 3rd part on checking for SOC AI readiness, focused on APIs
Mark Johnston retweeted
Come on, if my dog [read: model] never bit anybody, this does not mean the dog is wimp, it perhaps means that we have a cage and we know dogs? :-)
Mark Johnston retweeted
Security leaders must prove financial value. 📊
Discover how Mandiant Cybersecurity Consulting acts as a true business enabler in a recent @IDC study: goo.gle/4bxsQlP
Join us on July 29 to unpack the data: goo.gle/4ePqSj0
Mark Johnston retweeted
I think this says more about how obvious the de-escalation path was than about my crisis management skills 😄
The similarities here go beyond the merely amusing all the way genuine absurdity. 😄
@cyb3rops I think you have a job at MS PR if you ever want it.
Mark Johnston retweeted
Replying to @bovaird_zach @CloudSecPodcast
Exactly, either "people saying that don't work in security" or if they do, they are bad at it :-(
Mark Johnston retweeted
We’ve identified industrial-scale distillation attacks on our models by DeepSeek, Moonshot AI, and MiniMax.
These labs created over 24,000 fraudulent accounts and generated over 16 million exchanges with Claude, extracting its capabilities to train and improve their own models.
Mark Johnston retweeted
"Why Does "Just Add AI" Fail for Security Operations?" and other fun quotes from @DropzoneAI here: dropzone.ai/blog/when-ai-get…
Mark Johnston retweeted
“Can I bring my baby to the interview?”
The message came in at 11 PM:
“Hi, I have an interview with you tomorrow at 2 PM. My childcare fell through. Can I bring my 8-month-old? I understand if you need to reschedule.”
Old me would have rescheduled.
Unprofessional. Distraction. Red flag.
New me replied:
“Absolutely. See you tomorrow.”
She showed up with her baby on her hip.
She apologized three times before even sitting down.
Ten minutes in, the baby started crying.
She tried to soothe him while answering questions.
She apologized again.
I stopped the interview and said:
“Hey. You’re managing a fussy baby, answering complex questions, and staying calm under pressure. That’s literally the job. Handling chaos while staying professional. You’re already proving you can do it.”
Her eyes filled with tears.
We hired her.
She’s been with us for a year now.
The most reliable team member we have.
Why?
Because when you’re used to handling a screaming infant at 3 AM and still showing up to work the next day, workplace stress feels like nothing.
Working parents, especially mothers, are some of the most organized, efficient, and resilient people you’ll ever hire.
Yet we lose them because our hiring processes are built for people with zero caregiving responsibilities.
If your interview process can’t accommodate a parent facing a childcare issue, you’re not filtering for professionalism.
You’re filtering for privilege.
Mark Johnston retweeted
"Implementing Secure AI Framework (#SAIF) Controls in Google Cloud" bit.ly/3KLShpR <- this blog launches a new paper on SAIF #AI controls in Google Cloud. More useful than fun, admittedly :-)
Mark Johnston retweeted
Our CFO asked me to "audit" our software subscriptions last week.
He sent me a spreadsheet with 200 rows. Slack, Zoom, Jira, Notion, Trello, Monday, Tuesday, Wednesday.
He wanted me to survey the team to see which tools were essential.
I told him: "Surveys are for people who care about feelings. I care about OpEx."
I deleted the spreadsheet.
Instead, I logged into the corporate Amex portal and reported the card as lost.
Every single auto-renewal in the company failed instantly.
I call this "The Scream Test."
It’s simple Darwinian procurement.
If a tool goes down and nobody runs to my desk screaming within 4 hours? We didn't need it.
The Marketing team was at my door in 10 minutes begging for Adobe. We renewed it. The Sales team was crying about the CRM in 20 minutes. We renewed it.
But here’s the interesting part.
The HR department’s "Employee Wellness & Engagement Portal" ($12,000/year) has been down for six days.
Not a single person has noticed.
I didn't just save money. I quantified the exact value of our corporate culture.
It is zero.
Stop auditing. Start unplugging. If it’s important, they’ll scream. If they don't scream, it’s just noise.
Mark Johnston retweeted
Last quarter I rolled out Microsoft Copilot to 4,000 employees.
$30 per seat per month.
$1.4 million annually.
I called it "digital transformation."
The board loved that phrase.
They approved it in eleven minutes.
No one asked what it would actually do.
Including me.
I told everyone it would "10x productivity."
That's not a real number.
But it sounds like one.
HR asked how we'd measure the 10x.
I said we'd "leverage analytics dashboards."
They stopped asking.
Three months later I checked the usage reports.
47 people had opened it.
12 had used it more than once.
One of them was me.
I used it to summarize an email I could have read in 30 seconds.
It took 45 seconds.
Plus the time it took to fix the hallucinations.
But I called it a "pilot success."
Success means the pilot didn't visibly fail.
The CFO asked about ROI.
I showed him a graph.
The graph went up and to the right.
It measured "AI enablement."
I made that metric up.
He nodded approvingly.
We're "AI-enabled" now.
I don't know what that means.
But it's in our investor deck.
A senior developer asked why we didn't use Claude or ChatGPT.
I said we needed "enterprise-grade security."
He asked what that meant.
I said "compliance."
He asked which compliance.
I said "all of them."
He looked skeptical.
I scheduled him for a "career development conversation."
He stopped asking questions.
Microsoft sent a case study team.
They wanted to feature us as a success story.
I told them we "saved 40,000 hours."
I calculated that number by multiplying employees by a number I made up.
They didn't verify it.
They never do.
Now we're on Microsoft's website.
"Global enterprise achieves 40,000 hours of productivity gains with Copilot."
The CEO shared it on LinkedIn.
He got 3,000 likes.
He's never used Copilot.
None of the executives have.
We have an exemption.
"Strategic focus requires minimal digital distraction."
I wrote that policy.
The licenses renew next month.
I'm requesting an expansion.
5,000 more seats.
We haven't used the first 4,000.
But this time we'll "drive adoption."
Adoption means mandatory training.
Training means a 45-minute webinar no one watches.
But completion will be tracked.
Completion is a metric.
Metrics go in dashboards.
Dashboards go in board presentations.
Board presentations get me promoted.
I'll be SVP by Q3.
I still don't know what Copilot does.
But I know what it's for.
It's for showing we're "investing in AI."
Investment means spending.
Spending means commitment.
Commitment means we're serious about the future.
The future is whatever I say it is.
As long as the graph goes up and to the right.
Mark Johnston retweeted
I'll tell you what, if you flex raw numbers of headcount, I am embarrassed for you. If you want to impress me, tell me about how your organization harnesses the strengths of diverse skill sets to accomplish its mission. Leading a small group of multidisciplinary specialists is far more impressive than a large organization of singular specialists.
Mark Johnston retweeted
"Cloud #CISO Perspectives: How Google secures #AI Agents" bit.ly/4jTiv5b <- a very fun read, new paper on securing agents at Google!



























