Amplifier Security

Your security team wasn't hired to chase employees and their devices. But that's where the week goes. When workforce devices stay patched automatically and risky behavior gets flagged before it becomes an incident, team members get their calendar back for the strategic work you actually hired them to do. Jason Kikta and Ryan Braunstein from Automox sat down with Thomas Donnelly at Amplifier Security to get into it. Link in comments 👇

Most security architecture teams have the same structural problem. They have great detection. Tenable finds the CVE. CrowdStrike flags the unmanaged device. SASE/CASB catches the shadow AI tool. Then what happens? A ticket gets opened. An email goes out. The dashboard entry ages. Detection without engagement is incomplete architecture. The missing layer isn't another scanner. It's a way to reach the employee, in the channel they actually use, and verify the fix actually happened. This is the gap we kept running into when we talked to Security Architecture and Engineering leaders — and it's why we started Amplifier Security What does the last mile between detection and remediation look like on your team? Curious if you're seeing the same pattern.

Mythos can find thousands of vulnerabilities at machine speed. Meanwhile, your employee still hasn't installed last Tuesday's patch. That's the whole problem. I talk to security architecture and engineering leaders every week. The detection side is solved. Scanners work. AI is making them even better. Nobody's arguing that. But here's what keeps not getting fixed: The last mile between "vuln found" and "vuln patched" on a laptop sitting in someone's kitchen. 70% of asset-owner attribution is accurate. Which means 30% of the time, you don't even know who to call. 90% of remediation emails get ignored. Average resolution time: 5+ days. Mythos doesn't change any of that. It just makes the backlog bigger. A lot bigger. The orgs that figure out the human side of remediation are the ones that survive this wave. Not the ones who scan faster. Our CTO Thomas Donnelly wrote the breakdown on what this architecture actually looks like and how to get ahead of the volume before it hits. [Blog] AI Is Finding Vulnerabilities Faster Than You Can Patch Them. Now What? Worth the read: https://lnkd.in/ey-ZXDXa

This isn’t yet another blog about Mythos and the AI vulnerability cataclysm. It’s a blog we published a few months ago about how we’re helping customers use AI to engage employees to more effectively fix vulnerabilities on their devices, and burn down risk more rapidly than they’ve been used to. It was the time that Anthropic outlined their internal attack and gave us a precursor to what could be coming next. Discovery, exploitation and fixing of vulnerabilities at machine-speed became a reality this week, but employees don’t operate at machine speed to fix their devices…because they are human, and it's always an interruption in their flow of work. Security teams don't have the bandwidth to chase down every person to map devices to owners, corral those who missed patching their devices, and ignored compliance alerts. Until now, customers were okay with a gradual burndown approach to vuln risk for employee devices. Every company has many such problems and will only fix a few of them at a time. But we are now seeing a reshaping of the security industry where employee device vulnerabilities are no longer a "safe can of worms" that security & IT teams can afford to ignore or delay patching. Today we should assume that employees are going to get socially engineered through AI phishing attacks to click the wrong links, leaving those devices vulnerable to known exploits. With the current AI adversary landscape, the "boring work" of patching workforce laptops, desktops and devices becomes more important than ever - it’s what ultimately hardens and shields the organization from the next breach. With the security industry refocusing on "fundamentals", it is shining a light on the last-mile problem within existing security programs. Solving this last-mile problem might be the most boring, yet important problem in workforce security. https://lnkd.in/gBaPsN4C

A lunch keynote on insider threats ended up being a pretty sharp reminder of what security teams are actually dealing with. On Monday we hosted a lunch event with our partners from P0 Security, Singulr AI, East Bay Cool Kids, Jen Winters, and Lume Security, with Eric O'Neill speaking. Eric is the former FBI counterintelligence operative who helped take down Robert Hanssen, and hearing him unpack how Hanssen operated for more than two decades was fascinating. What stayed with us, however, was the quieter point underneath it: trust, access, and human behavior are still where so much risk shows up. Not because technology is irrelevant, obviously, but because people are usually the ones making the decisions systems can't fully control. That lands especially hard for those of us focused on building human resilience at work. You can invest in all the right tools and still miss the part that determines whether someone notices something off, speaks up, or makes a better choice under pressure. A very good Monday lunch, and a useful reminder that security is still deeply human.

It was great mingling and chatting with security leaders before the RSAC rush this past Sunday. Got to enjoy delicious food and drinks, and even better conversations with familiar faces and new friends! Looking forward to creating a more secure future together with stronger human risk management! And a shout out to Kathy Kolenko for helping organize the event!

Big news from RSA Conference! 🎉 We just announced the first agentic platform for Human Risk Management (HRM) that provides full-stack remediation across devices, applications, identities and behaviors. We're moving security beyond simple awareness to operationalize HRM at enterprise-scale. Ready to turn managing human risk into an operational discipline? Learn more and get started at: https://lnkd.in/eG2Qqgb9 #RSAConference #CyberSecurity

RSAC That's right Anand Thangaraju! Let's Gooooooo!! 🙌 Security Leaders, I'm kick starting my 16th RSA CISO Soiree tomorrow Evening. DM me for a private invitation! We thank Shreyas Sadalgi and his Team, Chris Simmons, Tommy Donnelly, #Amplifiersecurity to host my 16th Annual Favorite RSA Kick-Off Soiree! #CISO, #Architect, #Cybersecurity, #ResponsibleAI, #AIGovernance, #RSAC, #AIandSecurity, #GCRAI, #securityawareness, #hrm, #usersecurity, #HumanRiskGraph, #VPcybersecurity,

This year we're amped up to host a cool VIP sit-down lunch at #RSAC. A good place to rest your feet and have a proper meal, just two blocks from Moscone. We’re hosting it at Fang featuring an unforgettable keynote from Eric O'Neill, former FBI Counter Intelligence Operative turned Nation Security Strategist. Eric will break down the operational realities of counterintelligence, AI-fueled attacks and the surveillance tradecraft shaping today’s threat landscape. Eric will also be signing his new book during the lunch, so bring your questions (and your appetite.) We took Caleb Sima's advice to plan our RSA event way ahead and host it at this iconic venue, versus scramble last minute (see link to his post below to know what I mean) 🤟 We have a couple of spots left, so hit us up if you're going to be there (invite below).