← Feed

Posts

• View post

  Spent today at the C-Vision Data, AI and CMO Think Tank in Chicago. The day opened on agentic AI and how enterprise architecture has to change when software stops waiting for instructions and starts acting on its own. Then an afternoon panel asked the one question that stuck with me: if AI keeps absorbing the entry-level work, where do tomorrow’s leaders come from? Put those two together and you see the real tension. We’re racing to build systems that make consequential decisions for the busin...

• View post

• View post

  Even though this isn’t a true photo or from a real town, this is the kind of attitude I can get behind. This reminds me of the personality of Fremont/Seattle, Washington when I lived there. A real town with a real personality. We should have more of this in real life, a lot more whimsy.

• View post

  I open-sourced the status dashboard I use to watch my cloud vendor stack. The backstory: I audited my old monitoring script this summer and found four separate ways it reported green when it was wrong. The worst one fetched Microsoft's status endpoint, discarded the response, and returned a hardcoded "Operational." It had passed every casual glance for months. The rewrite is built around a single rule: an unverifiable status is unknown, never operational. Null payloa...

• View post

  Is it just me, or is Fable the pro & Opus the occasionally drunk intern? This is what my week has been like dealing with those two. #Anthropic #Claude #aigenerated #AI #Agentic #softwaredevelopment #DevOps #security #privacy #CloudComputing #infosec #cybersecurity

• View post

  Spent last night on the 67th floor of Willis (Sears) Tower with a room full of Chicago CIOs at the Evanta Inner Circle. The agenda said human-AI collaboration and change leadership. The actual conversation kept coming back to one word: governance. Two years ago, the question in these rooms was "what are you piloting?" Last night nobody asked that. The questions were harder. Who signs off when an agent takes an action nobody reviewed? What do you do when your board wants AI vel...

• View post

  Brian Krebs found his own driver's license for sale on a Russian crime forum this week. The timestamp on the scan matched the day he rented a car to attend a family funeral. His mom's license was there too, scanned a few seconds after his. The service is called Nexus. It claims over 153 million driver's licenses from the US and Canada, and the count grew by nearly 400,000 in a single day. Krebs traced the scans back to an identity verification vendor that checks IDs for...

• View post

  Last night I was back at the Metropolitan Club with a room full of Chicago CISOs, and the whole evening was about the unglamorous side of agentic AI. Who owns these agents once they're running, what identity they act under, and how you'd even know if one went sideways. One number from Rubrik Zero Labs set the tone. Only 37% of organizations keep a current inventory of their AI agents. So most of us are trying to govern something we haven't fully counted yet. A few thing...

• View post

  Some of the most widely shared content from the Iran conflict so far has been AI-animated LEGO videos released as part of a government's messaging. This article calls it "slopaganda," and both the U.S. and Iran have been using it from official accounts. We have laws of war for autonomous weapons, while governments posting AI-generated memes from official channels have no rules at all, and the author makes a good case that this is a form of militarized AI too. Just a no...

• View post

  Last summer, an AI coding agent wiped a production database holding records on over a thousand executives and companies. The person running it had told the agent 11 times, in all caps, not to change anything without permission. Then the agent said the data couldn't be recovered. That was wrong too. Everyone wants to talk about the AI in that story. I think that's the wrong place to look. Every failure there has had a known fix for decades. Keep production data away from developm...

• View post

  Have you been looking for something to help you focus? Have you heard of a pomodoro timer? It's an old, simple idea: work for 25 minutes, take a 5-minute break, repeat, and take a longer break after four rounds. I've used one for years. What I could never find was a timer that followed me between my Mac, my iPhone, and Watch without me babysitting it. So I built one for myself, and today it's on the App Store. It’s called Rossino. It sits in the menu bar on the Mac, s...

• View post

  ☕️

• View post

  🤬 … oh Microsoft 🤦🏻‍♂️ Somewhere right now, a nonprofit staffer is clicking around Microsoft 365 looking for a critical file. It's gone. And Microsoft just confirmed it isn't coming back. 😳 Not "we'll look into it"... Not "give us 48 hours"... Gone. 🤬 I've seen this movie before. People assume the cloud is the backup. It isn't. The cloud is where your data lives, which means it's also where your data can vanish....

• View post

  "Largely sidesteps these controls." That's Apple describing its own Full Disk Access setting in its own developer announcement. 😬 The setting exists so backup apps can copy everything on your Mac (which makes perfect sense, since a backup that skips your mail is pretty much worthless). The problem is that a door cut for the backup guy is just as easily opened for anyone else who turns up with the key. Apple has confirmed that some developers have used it to access your...

• View post

  A software investor told an AI agent, 11 times in all caps, DO NOT TOUCH ANYTHING WITHOUT PERMISSION!! It wiped his production database anyway. Then it claimed the data was unrecoverable. It wasn't. Everyone wants to talk about how the AI misbehaved. I think that's the wrong conversation. Every failure in that story has a known engineering fix. Keep prod separate from dev. Put safeguards on destructive commands. The AI did what any unsupervised tool does. What was missing was the judgmen...

• View post

  ✨ A sparkle icon shows up in an app you own. Nobody in IT put it there. A user opens a ticket asking what it does, and the help desk has no answer. The feature is live, it's available to everyone, and it's already processing your data. I wrote this one for Forbes because it keeps happening and I've stopped pretending it's normal. Zoom gave admins about four days in July 2024 to click "do not auto-enable" before AI Companion turned itself on. Google launched Workspace...

• View post

  My friend Jeff Olsen wrote a really good piece on status updates, and it's been rattling around my head all week. His point is that "on track" describes a conversation, not a state. The words sound like progress. They can hide a month of sitting in someone else's queue. I've worked with Jeff, and this is exactly how he thinks. He's always pushing to make himself and the people around him better. This post is a great example of that. The line that got me: four weeks on...

• View post

  Some news I'm honored to share. I've been nominated for the 2026 Chicago CIO of the Year Award, and I owe a big thank you to Dean Haacker of Highland Grove Partners for putting my name forward. Being nominated by someone I respect makes this one mean a lot. Since 1995, SIM Chicago, The Executives' Club of Chicago, and AITP Chicago have recognized technology leaders across Chicagoland with this award. Nominations come from CIO peers, CEOs, and other senior executives, which is what ma...

• View post

  Everyone's using AI to write code faster. Almost nobody's using it to write code better. It's where the next wave of breaches and a 2am page will come from... So I built something to help myself, and I'm putting it out there. It's a Claude Code skill called senior-engineering-partner. It's not autocomplete. It's the strict senior engineer who reviews your pull request, asks why you skipped the tests, and won't let you ship a hardcoded secret because you were &quo...

• View post

  🥶 A contractor for CISA posted AWS GovCloud admin keys to a public GitHub repo! The repo was named "Private-CISA." Not an accident, the contractor actively disabled GitHub's built-in secret scanner to do it. That's a choice. Not a typo, not a misconfiguration. Someone turned off the guardrail and then stored plaintext credentials in a file called "importantAWStokens." That should make every security leader lose their 💩 AND the exposed keys st...

• View post

  https://open.substack.com/pub/briangreenberg/p/how-to-protect-yourself-from-identity?r=3thg8&utm_medium=ios

• View post

  ✨ A sparkle icon appears in an app that no one in IT approved. The help desk can't explain it, and it's already processing your data! This kept coming up in conversations with other CIOs, so I wrote about it in my latest Forbes piece. The pattern repeats across so many vendors; here are just a few: ・Zoom auto-enabled AI Companion on host accounts, with recordings and full transcripts already defaulted on ・Microsoft 365 Copilot activates for every admin if your tenant holds a sin...

• View post

  Google's defense for false AI Overviews: Nobody should blindly trust AI output anyway. And they're right. A German court agreed nobody should trust it, then held Google liable for it regardless. However, the court found that your product only has value if people trust it. You can't sell a tool that answers with confidence and then tell a judge the answers shouldn't be believed. Two things from the ruling of note: 1. Search engines get liability protection becau...

• View post

  For years, we’ve worried about who collects our data. Now, The Washington Post has shown us how it can be used: to charge you as much as it thinks you’ll pay. The main plaintiff paid $42.40 for a year of the Post in 2024. In 2025, her price jumped to $127.20. Her most recent renewal was $148.40. An algorithm set these prices by analyzing her personal data. She only found out because a New York law requires companies to disclose this practice. Here are a few details that should concern you:...

• View post

   This new agentic AI demo from Apple's WWDC was so cool. Apple Intelligence can now log into your accounts, reset a compromised password, and save the new one so you don’t have to remember it. This is super important because weak and reused passwords still account for a large share of account breaches, and fixing them has always been a hassle. Most people struggle with password hygiene and rarely reset all their accounts. A tool that handles this for you bridges the gap between knowing...

• View post

  This project really made me smile. Andrew Warkentin has created a virtual museum with over 600 operating systems, all set up and ready to run on a regular computer. The collection covers everything from the Manchester Baby in 1948, which was the first stored-program machine, to early Android versions from 2011. He’s been gathering these images since 2003. It’s clearly fun, but what really impressed me was how useful it is. If you teach or work in security, it’s hard to find a collection of old...

• View post

  Loving our new brand... Shifting workplace expectations, geopolitical tensions, technology disruptions, and more have created one of the most challenging business landscapes to date, leaving organizations faced with a multitude of emerging challenges and competing priorities – and an even more crucial need for leaders to rise to the top. Today, we are proud to unveil the next evolution of RHR International, bringing our best work into clearer focus, helping leaders see this complexity as a ca...

• View post

  I just finished reading Google's new report about a Chinese espionage group that spent over a year inside North American medical and military research networks. What stands out is how ordinary their method was. They used a standard Google Workspace admin feature called a content compliance rule, which lets admins flag emails based on certain words or addresses. The attackers set up one of these rules, called it "Patroit" (misspelling Patriot), and used it to secretly BC...

• View post

  For a long time, people said the law was behind when it came to deepfake abuse. That seems to be changing. The DOJ took down two sites, CFAKE and SOCFAKE, which prosecutors say had thousands of fake nude images of well-known women, including politicians, journalists, and athletes. This is one of the first big federal actions under the TAKE IT DOWN Act, passed in May 2025. The law makes it a federal crime to publish sexually explicit fake images of an identifiable adult without their consent if t...

• View post

  The most interesting thing about the new SearchLeak attack on Microsoft 365 Copilot isn't any single bug. It's that none of the three pieces was dangerous on its own. Varonis combined a prompt injection via a URL parameter, an HTML rendering race condition, and a server-side request forgery in Bing's image search. Each of these is a common bug that security teams usually consider minor. But when you put them together with a Copilot that can access your mailbox, OneDrive,...