Founder @SecureTailwinds | Commercial Pilot | Flight Instructor | Prior @TalosSecurity #DFIR biz leader | @TEDx Speaker --Opinions expressed are mine alone.
Indiana, USA 🛫
Joined February 2009
- Tweets3.8K
- Following386
- Followers1.3K
- Likes426
Pinned Tweet
📣Today, I am thrilled to announce the official launch of Secure Tailwinds, LLC! Our portfolio and go-to-market will be simple, powered by deep expertise. @SecureTailwinds is an advisory firm providing consulting and training services for cyber incident readiness, response, and business resiliency. As the Founder and Principal, I am beyond thrilled for this unique opportunity! I am grateful to so many folks in my network that encouraged me to go down this entrepreneurial path. I am looking forward to serving some great organizations and partnering with colleagues in industry to serve mutual clients. Secure Tailwinds has been cleared for an unrestricted climb into the market's airspace, which comes with great upside, but not without risk and headwinds. I will share more in the future!
🌟 Secure Tailwinds' Centerpoint: A focal point for my business will be helping organizations at the intersection of cyber, aviation, and artificial intelligence with an emphasis on cyber readiness. As an old-school #DFIR guy, pilot, teacher, coach, and investigator, there are some tough challenges out there to solve and I am looking forward to partnering with organizations and teams at the forefront that are focused on moving the needle forward where tailwinds and blue skies prevail!
#OpenToWork: My background and expertise are vast across various industry verticals and domains. If you have an interesting problem to solve, please reach out to me to see how I can help! From third-party expertise/validation, DFIR, incident readiness services, insider threat, internal legal investigations, training/teaching your workforce, or building an IR program...we can help. On a case-by-case basis, I can be retained for fractional uber-incident command work for current IR service providers or clients that need battle-tested leadership to drive successful cyber incident response. Currently, I am focused on the U.S. mid-market, but that will likely change in the future. I do have the ability to travel to support your unique needs. +1 855-SEC-TAIL or securetailwinds.com/contact
➕Action: How can you help? Like and re-share would be appreciated! Spread the word and add my company to your rolodex. If you are looking to tap into my expertise, please reach out and let me know how I can serve you. Let's Go!
“Do what you can, with what you have, where you are.” – Theodore Roosevelt
“The future belongs to those who learn more skills and combine them in creative ways.” – Robert Greene
Brad Garnett retweeted
Cyber is going to be one of the most profound aspects of AI. We now have a tireless workforce that can hunt down, discover, patch, or attack any system and software ever created.
We will use agents to identify the long standing risks in existing systems and infrastructure. Attackers will use agents to accelerate the discovery of gaps in environments. We will equally use agents to defend attacks and discover anomalous patterns to better protect our data, and much more.
We’re entering a new cyber regime, and we’ll probably use 100X more tokens on this loop than we’re imagining right now, because we can scan every log, look at every line of code, look through traffic, and process data at a scale that wasn’t comprehensible before.
More than ever, enterprises are going to care deeply about how they manage their networks, systems, software, data, identity, devices, and more. Agents will largely become the solution to these challenges, but they will keep everyone up in the process.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Incredible innovation by Blake and his team! Not only bringing back supersonic air travel, but opportunities in the energy sector to meet requirements for AI! 👀
Brad Garnett retweeted
Our first findings from the CAIRN project analyze CLOSEDQUORUM, the first documented autonomous AI C2 implant to demonstrate "effort displacement." Read our latest blog to understand how this architecture allows AI to execute attack phases independently: cs.co/6019BGb7Jh
Brad Garnett retweeted
Please don't install - it's trivial to turn Muse into the ultimate backdoor 💀👀
Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life.
But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.
Let me show you. 🧵
Brad Garnett retweeted
Stop scrolling and watch this. (This is important.)
Zack Korman Just published one of the best opinion pieces I've seen on the OpenAI incident, and it reframes the whole thing as cybersecurity versus AI safety. [11/12] minutes. Worth every one of them.
No. Really - watch it. Give it a think. It's important. I need a bunch of people debating this. I have to think about this as well, but it needs to be debated.
My admission: I'd been meaning to figure out who METR actually is for over a week. It kept bugging me. Then I forgot and slid straight into assumption land. Nobody else was questioning them, so they must be qualified. (My internal skeptic apparently took the week off.)
Then this video. The number of questions it opened up for me felt like a punch in the face. I was so excited that a public incident report existed at all (credit where due; publishing one is still rare and still commendable) that I skipped the part where I interrogate whether the folks who wrote it took a single SANS class (or any class in cybersecurity)
If you work in incident response, if you work anywhere in cybersecurity, this should be required listening today. Watch it, then repost it and get it in front of your team.
We need some discourse on this. The cybersecurity insurance industry especially - are you ok with this too? Regulatory? The impacts cascade - and this is the only piece that does a wonderful job on the pitfalls that METR did on this. (And if there is a ton of discourse on this already - I'll admit that I must be focused on Openclaw 2.0 a bit that I've been distracted.)
Brad Garnett retweeted
It's not time to slow down but to accelerate!
The recent AI-powered cyberattacks have everyone talking about the risks of AI. We should. But let's not lose sight of the bigger picture!
If we work hard at it, AI will make the world safer, not less safe, just as most major technologies have.
We've already seen a glimpse of that: we defended ourselves with AI (more specifically an open model). The same systems that helped stop an AI-powered cyberattack can now help defend against millions of cyberattacks every day, while helping us identify and fix vulnerabilities before attackers exploit them.
To get there, we need three things in my opinion:
- Increase transparency with mandatory trace sharing and incident disclosure for agent cyber-attacks
- Keep AI-powered cyberattacks illegal, with meaningful penalties to disincentivize them
- Equip defenders with the best AI, especially open models, to reduce the asymmetry of capabilities between attackers and defenders
If we get those three things right, AI won't just create new cybersecurity challenges, it will make cybersecurity fundamentally and meaningfully stronger.
And that's before considering AI's impact on science, healthcare, education, productivity, and much more.
It's not time to slow down but to accelerate!
“Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.”
In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations.
Our post describes what happened, how it happened, and what we’re changing. We encourage other AI developers to perform similar reviews.
We conducted this review together with @Irregular, one of our evaluation partners, and thank them for the joint investigation and their collaboration on this post. This type of collaboration is increasingly critical to safe, rigorous evaluation of models, and we look forward to continuing to work together on security.
anthropic.com/news/investiga…
The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for what’s next.
huggingface.co/blog/agent-in…
Brad Garnett retweeted
Attackers have frontier AI. Defenders need a frontier AI ecosystem—the best open and closed models, force-multiplied by a global community.
During the Hugging Face incident, closed AI blocked essential forensics. An open-weight frontier model helped contain the intrusion.
That’s why we created the Open Secure AI Alliance.
AI security advances when the industry builds in the open, together.
We're introducing the Open Secure AI Alliance with industry leaders to develop new techniques and tools to safeguard software and agents.
By sharing models, tooling and research in the open, we can broaden the community of defenders.
Learn more about the founding members’ contributions: nvda.ws/4pD8Fc5
ALT Logos of various companies including Adobe, Cisco, and Microsoft.
Brad Garnett retweeted
To summarize: HuggingFace got autonomously compromised by a model from an American company. HF then tried to use American frontier model(s) to defend themselves, but were blocked by guardrails. HF then had to turn to open source Chinese models to defend themselves from another American company.
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
openai.com/index/hugging-fac…
Brad Garnett retweeted
This is a wild read
openai.com/index/hugging-fac…
Brad Garnett retweeted
Sounil Yu and I co-authored the AI Defense Matrix, the security-for-AI companion to his Cyber Defense Matrix. It maps eight AI asset classes to NIST CSF functions, so security leaders can find gaps and vendors map products.
teapawt.net/lennyzeltser/status/20…
Brad Garnett retweeted
NightBeacon is changing the game for us @Binary_Defense - we have this technology so dialed into every aspect of what we do. Our MTTD and MTTR has drastically been reduces to seconds and minutes, not multiple minutes or hours. Truly revolutionary technology that I've been building over the past year, and that is fully integrated into how we do work everyday at Binary Defense.
We had a new customer onboarded and up and running in 7 minutes. SEVEN minutes. Full agentic workflow, full AI enrichment based on our own training models - 87.43% reduction in false positives in 7 minutes.
Interested in what we are doing? Even if you don't need our MDR services, NightBeacon can be integrated into your existing technology, tooling, MDR, MSSP - doesn't matter for us - we just want to help. Not marketing fluff, real things that are working today that changes everything we do.
Reach out to us anytime.
#BinaryDefense
binarydefense.com/company/co…
Brad Garnett retweeted
For the enterprises using Claude, if you are using it for heavy enterprise type stuff - be extremely careful. It's introducing massive bugs, security issues, and code quality is way worse than Opus 4.5, substantially worse on both 4.6 and 4.7.
Our entire development team is shifting off of it. It's unusable at the moment aside from beautiful UI stuff, it's code quality is not something you can trust.
Still no word from Claude on why they mangled their models and didn't tell anyone - which is particularly alarming on every front.
I would recommend switching teams over to something like Cursor, Perplexity, or AWS Bedrock - as the frontier models continue to innovate (or regress) - having the ability for flexible model selection that doesn't disrupt development workflow will be insanely important for enterprise.
Brad Garnett retweeted
Google Threat Intelligence Group is tracking an active supply chain attack 🔎
North Korea-nexus actor UNC1069 compromised the "axios" NPM package (v1.14.1 & 0.30.4), deploying the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Learn more: bit.ly/3NZR3Zv
Investigating the axios npm package supply chain compromise? Actionable intel and rapid response actions detailed here by Huntress!
Leadership tip: Anyone else a fan of walking meetings? There’s good health science behind it, but from a productivity standpoint, it can mean more dialogue and less monologue amongst participants ensuring everyone is heard and the best ideas for outcomes rise to the top. Whether you’re a leader, or a teammate give it a try. Challenge your leader in your next 1:1 to encourage walking meetings for either in-person or virtual meetings.