Safety U Security. Deputy CISO @ Salesforce. 4xCISO; previously of Google, AWS, and athenahealth. Still focused on making the internet better for all.
Boston, MA
Joined December 2018
- Tweets693
- Following80
- Followers429
- Likes523
Pinned Tweet
Cyber attacks have shut down healthcare systems and stopped sick people from getting care. It's unacceptable. Glad to see the work we're doing to stabilize and build a more secure, resilient healthcare infrastructure. #healthcare #resilience #cybersecuritynews
Proud to work @Google. whitehouse.gov/briefing-room…
I predict WAF might actually start to get good.
Surviving the "Patchless Window"
In a "negative time-to-exploit" landscape, waiting for patches to reach every edge device or legacy server creates exposure. Auto-adjusting active controls, runtime mitigations, and high-level policy intent buy vital time while deployment catches up.
philvenables.com/post/the-vu…
20
Taylor Lehmann retweeted
Fuck you. Whoever made this site. You win.
I’ve never had a site get my blood boiling like this before
This is so messed up.
opusfived.dev
Taylor Lehmann retweeted
Cyber is having a moment
Across 21 major software companies, including Apple, AWS, Microsoft, and Google:
- Reported critical vulnerabilities never cleared 100 per month in four years
- Since spring they've jumped to over 600 per month
Charts of the Week: a16z.news/p/chart-of-the-wee…
Crazy it’s been 10 years. Big rally in Kingston tomorrow. Wish all my peoples the best.
10 years ago today we played our final show together as a band. We still remember it like it was yesterday. Miss you Gord.
The live album arrives tomorrow, Aug 21, and the worldwide rebroadcast of that final show in Kingston airs Aug 22. More info at linktr.ee/thehip
93
Taylor Lehmann retweeted
Mythos/Fable is out...
Before the thought leaders start publish whitepapers, or hosting "CISO dinners" etc, I'll offer some boring/sobering advice:
1. Make sure you know where all your stuff is - ya even that 3rd party software that the person in accounting bought on a credit card in 2016.
2. Make sure you understand how to patch / update all of your stuff as fixes come out. Quickly. Bad guys have no respect for risk acceptances and patch windows.
3. Make sure that you've hardened anything external facing as best you can.
4. Hydrate, get sleep. It's a marathon not a sprint
5. As per Jurassic Park...
A post Mythos Strategy for beginners (thread):
1. Reduce attack surface on all the things (start where it makes sense, but @chainguard_dev is a way...)
6
1
175
5. All the things we've been saying for years - hardware backed MFA, microsegmentation (physically and logically), etc. zero-trust-ification of your things.
50
4. If you work in cyber, call your town municipal water / sewer services, rural hospitals, and basically anyone else @joshcorman recommends need help, and help them get a plan together.
1
1
101
3. Read @anton_chuvakin's blog and do the things - cloud.google.com/blog/produc… esp #2, #4, and 9
2. Acknowledge CVEs can no longer be prioritized in isolation
2a. Adjust pipelines to patch more, faster (configs too)
2b. Update post deployment validation procedures - ++ precision & recall
2c. Take a harder look at things like Assured Open Source (cloud.google.com/security/pr…)
Taylor Lehmann retweeted
Remember kids… in theory, we buy security products to keep the bad guys OUT… not to let them IN…
Great responsibility
Your firewalls are now getting owned.
In the past 10 days:
→ WatchGuard Firebox (CVE-2025-14733) - CVSS 9.3 Out-of-bounds write in Fireware OS. RCE via VPN. 125,000+ vulnerable devices globally. CISA deadline is TODAY. Same attacker IP (199.247.7.82) hitting multiple vendors.
→ SonicWall SMA1000 (CVE-2025-40602) - CVSS 9.8 Missing authorization flaw. Attackers are chaining it with CVE-2025-23006 for unauthenticated root RCE. Zero-day exploitation confirmed.
→ Fortinet SSO Bypass (CVE-2025-59718/59719) - CVSS 9.8 Auth bypass via crafted SAML assertions. Affects FortiOS, FortiWeb, FortiProxy, FortiSwitchManager. Attackers can log in without credentials and dump your config.
Three different vendors, all critical and all actively exploited.
All in the same week.
Coincidence? This seems to be a coordinated campaign.
The devices you bought to protect your network are now your attack surface. Firewalls, VPN concentrators, email gateways.
Attackers know these sit at the perimeter with high privileges and minimal monitoring.
When's the last time you ran a vuln scan against your security stack?
Patch. Hunt. Assume compromise.
#Cybersecurity #Firewall #ZeroDay #CVE #WatchGuard #SonicWall #Fortinet #ThreatHunting #CISO #EdgeSecurity
