94% of orgs believe they are prepared for a major cyber incident. The reality? Teams achieve only 22% decision accuracy during practical simulations. The fix? Stop testing in silos. Watch the full session below to learn how bridging Tabletop Exercises (TTX) with live TTP Replay exposes true detection gaps and mathematically proves your cyber readiness. Drop your questions in the thread! Dr. Mark Arnold (@lotusebhat) & Mike Crouch are hanging out in the replies and ready to answer them. 👇

Unauthenticated RCE in PHP itself. Not a plugin, the runtime. CVSS 9.2, exploited in the wild. Do you know every server running PHP in your environment? If not, start there. Free consultation: lares.com/contact

AI governance is five decisions: Which systems. Who owns them. What data they touch. Which actions need approval. How it's tested. Most programs can't answer all five.

Your tabletop says the SOC would catch it in ten minutes. The replay shows whether anything fired at all. New on the Lares blog: TTX + TTP replay for AI incidents. lares.com/blog/ai-incident-t…

Models update. Prompts change. Permissions widen. Your last AI test is already expiring. Point-in-time testing rots. Retest on cadence.

You can't govern AI you haven't found. Shadow models, expensed tools, agents wired to internal data. AI Footprint Discovery finds it all, including the parts your governance doesn't know about. lares.com/blog/adversarial-a…

Your tabletop says you'd detect it. Your telemetry has never been asked. Stop assuming. Start proving.

89% of enterprise AI usage is invisible to security teams. You can't govern what you can't see. (CSA, 2026) lares.com/AI

Most security tests grade your defenses. A red team grades your detection. It's not whether you have the control. It's whether your team sees the attack happening in the first ten minutes. Assumed-breach testing answers that. Everything else is a checklist. lares.com/red

Governance tells you what should happen. Adversarial testing tells you what does. New Lares blog: the Adversarial AI Assessment, and why your AI governance documents aren't evidence. lares.com/blog/adversarial-a…

A giant assessment can still answer none of the questions leadership cares about. Pentesting 101 starts with one named risk question, then builds the scope around the evidence needed to answer it. Write the risk question before writing the scope. lares.com

"Eyes of both a protector and an attacker." That's how a client's security lead described our team this week, after a debrief on work our team delivered. Eight years of pen testing, four in his current leadership role. His verdict: one of the most thorough and professional reports he'd ever seen. "Sometimes an outsider, specifically one that does see this type of test and has basically the eyes of both a protector and an attacker, I think it's most beneficial." Couldn't have said it better ourselves.

A single stolen token should not erase every trust boundary in your environment. Follow shared credentials, over-scoped service accounts, and broad connector permissions from foothold to impact. Test whether defenders can break the chain. lares.com

An OT asset inventory can be complete and still hide the path that matters. Follow remote access, vendor routes, exposed devices, and IT-to-OT trust to see where containment actually breaks. Test the boundary, not just the inventory. Learn more: lares.com/critical-infrastru… or lares.com/oil-gas-energy/

Finding a gap is not proof of improvement. Readiness becomes evidence-based, not imagined, when you combine the tabletop exercise with TTP replay. Stop guessing. Start proving. Prove it, don't assume it. Learn more: lares.com/blog/ttxttp-webina…

Your AI policy does not prove your AI is safe. Governance holds when five decisions are explicit: systems in scope, use-case owners, data each system can touch, actions needing human approval, and how unsafe behavior gets tested. Test the boundary, not just the binder. Learn more: lares.com/business-security-…

A SIEM alert does not prove readiness. In this clip, Mark Arnold (@lotusebhat) maps telemetry back to the tabletop: closing the loop between what the exercise assumes and what the environment actually produces. Would this thing detect 'X'? Stop assuming. Prove it. Trace the signal all the way to the decision.