Sign in to view Marcus’ full profile
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
Sign in to view Marcus’ full profile
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
Los Angeles, California, United States
Sign in to view Marcus’ full profile
Marcus can introduce you to 5 people at Expel
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
63K followers
500+ connections
Sign in to view Marcus’ full profile
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
View mutual connections with Marcus
Marcus can introduce you to 5 people at Expel
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
View mutual connections with Marcus
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
Sign in to view Marcus’ full profile
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
About
Welcome back
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
New to LinkedIn? Join now
Activity
63K followers
-
Marcus Hutchins shared thisWant to know what's actually worth worrying about in the world of AI cybersecurity threats? Don't forget to reserve your spot! We'll be going live on April 14, at 1 pm ET.Marcus Hutchins shared thisAI-generated phishing is real. AI-assisted code is real. But "autonomous AI malware wrecking cybersecurity"? That's a different conversation. On April 14, Marcus Hutchins and Aaron Walton join Ben Baker for a Nerdy 30 session to cut through the noise. We'll talk about where AI is genuinely changing attacker behavior, where it's still more hype than harm, and what the long game looks like as the tooling keeps getting better. Join us at 1pm ET for a practitioner-first look at the threat landscape without the sales pitch.
-
Marcus Hutchins posted thisI ve had this really cool project I’m super close to finishing, but keep getting interrupted. I was so glad to get back from RSA so I can complete it, so of course I get sick the second I get home 😭
-
Marcus Hutchins posted this“We’re launching a new cybersecurity product that points at fires” “Does it put out any of the fires?” “No, but it is very good at pointing at them”
-
Marcus Hutchins shared thisPresident "no new wars" has just announced that after spending $20 billion causing the worst global energy crisis in history, the US has successfully eliminated Iran's non-existent nuclear weapons.
-
Marcus Hutchins shared thisLast chance to register for my webinar with • Anders A. It goes live at 11am ET today! We have some great topics to discuss from state sponsored cybercrime to how I become a hacker. Still 3 hours left to reserve your spot! https://lnkd.in/eq5_5nMDThrough the Eyes of the Adversary: Identity Abuse in Real-World BreachesThrough the Eyes of the Adversary: Identity Abuse in Real-World Breaches
-
Marcus Hutchins posted thisGenerative AI is costing me a fair amount of work tbh. Clients will contract me to work on projects they started themselves using Generative AI, I'll taking one look at the unholy heap of AI slop they've produced, then deciding I'd rather be broke than attempt to fix that. It's like working as a contractor where the client wants to save money by helping you remodel their kitchen, but they've installed all the cabinets upside down, somehow the sink is on the ceiling, and the washing machine is hooked up to the gas main.
-
Marcus Hutchins shared thisCome fly with me and see how I optimize travel as the final boss of Type-B personalities
-
Marcus Hutchins shared thisThe IAM attack surface is growing fast. With millions of businesses now incorporating Agentic AI, the identities that security teams must protect are piling up. Join me & Anders Askasen for a live session that will explore these very challenges. The session, Through the Eyes of the Adversary: Identity Abuse in Real-World Breaches, will take place on March 31 at 11am ET: https://lnkd.in/eq5_5nMD I strongly believe in defenders taking the time to learn how attackers think & operate. This session with Radiant Logic will do just that. See you there!
-
Marcus Hutchins posted thisOh no, I've accidentally leaked details about my new super duper AI model that's definitely going to be good this time I promise. Please don't tell anyone, and please don't spend all month hyping it up on LinkedIn for free despite never having even used it. I'm so embarrassed about this mistake, anyway here's my bank account if you'd like to wire another trillion dollars in VC money for me to vaporize.
-
Marcus Hutchins liked thisMarcus Hutchins liked thisAI-generated phishing is real. AI-assisted code is real. But "autonomous AI malware wrecking cybersecurity"? That's a different conversation. On April 14, Marcus Hutchins and Aaron Walton join Ben Baker for a Nerdy 30 session to cut through the noise. We'll talk about where AI is genuinely changing attacker behavior, where it's still more hype than harm, and what the long game looks like as the tooling keeps getting better. Join us at 1pm ET for a practitioner-first look at the threat landscape without the sales pitch.
-
Marcus Hutchins liked thisSlightly awkward that some of the most mature attitudes to adopting AI in business processes seem to be coming from cyber criminalsMarcus Hutchins liked this⁉️ Are ransomware gangs using AI? Why not ask them... ⁉️ I'm in contact with a dozen or so ransomware operators, so I asked them if they were using AI in their operations. The following is by no means exhaustive and of course comes from a group of profoundly untrustworthy people, but it echoes what I've found before - there seems to be relatively low adoption of AI among these groups. Which supports a point I've also made before: NOW is the time for defenders to double down on AI, while the running is on their side of the pitch! "We use very little AI. Basically, when we have a data stream, we can use AI to quickly identify the organisation or types of data we have. As for hacking itself, that only happens with real professionals, no AI." "Not in operations, it's a terrible idea if you have access to a good company." "AI serves as a simplification of everyday tasks, nothing more. It should not be allowed into processes that require maximum control and high risk: humans are better suited to these tasks, not AI."
-
Marcus Hutchins liked thisThis is bound to be a great conversation! Come hear the difference between the speculation and the actual, the hot takes versus the real.Marcus Hutchins liked thisAI-generated phishing is real. AI-assisted code is real. But "autonomous AI malware wrecking cybersecurity"? That's a different conversation. On April 14, Marcus Hutchins and Aaron Walton join Ben Baker for a Nerdy 30 session to cut through the noise. We'll talk about where AI is genuinely changing attacker behavior, where it's still more hype than harm, and what the long game looks like as the tooling keeps getting better. Join us at 1pm ET for a practitioner-first look at the threat landscape without the sales pitch.
-
Marcus Hutchins liked thisMarcus Hutchins liked this⚠️ Our team at Google Threat Intelligence Group is releasing more details on the recent supply chain campaign targeting the popular NPM package #axios. Notably, we now attribute this attack to #UNC1069, a financially motivated North Korea 🇰🇵 nexus threat actor active since 2018. We made this attribution based on their use of WAVESHAPER.V2, an updated version of a backdoor previously used by the group, along with clear overlaps in command and control infrastructure. The impact of this attack is broad and has significant ripple effects, as countless other popular packages rely on axios as a dependency. UNC1069 isn’t the only threat actor that has launched successful open-source supply chain attacks in recent weeks. Other groups, such as TeamPCP (UNC6780), have recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations. 2026 is quickly shaping up to be the year of the supply chain. Hundreds of thousands of stolen secrets could potentially be circulating as a result of these recent attacks. Over the near term, these compromised credentials could enable further software supply chain attacks, software-as-a-service (SaaS) environment compromises (leading to downstream customer breaches), ransomware and extortion events, and cryptocurrency theft. Defenders should pay close attention to these campaigns, and enterprises should initiate dedicated efforts to assess the existing impact, remediate compromised systems, and harden environments against future attacks. Read our full analysis for indicators of compromise (IOCs) and remediation guidance. Link in the comments below.
Experience & Education
-
Expel
********* ****** **********
-
*** ******* *****
******** ***** ******
-
***********
***** ****** *******
View Marcus’s full experience
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
Welcome back
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
New to LinkedIn? Join now
Recommendations received
View Marcus’ full profile
-
See who you know in common
-
Get introduced
-
Contact Marcus directly
Other similar profiles
Explore more posts
-
Tim Callan
6K followers
Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg
34
1 Comment -
Tim Callan
6K followers
MPIC (Multi-perspective Issuance Corroboration) is soon to move into enforcement phase. In this Root Causes Podcast episode Jason Soroko and I describe three configuration decisions that can force Domain Control Validation (DCV) to fail and tell you what to do about them. Audio: https://lnkd.in/g5kTP-c4 Video: https://lnkd.in/g2Eug8BN
16
-
Caitlin Condon
VulnCheck • 4K followers
I'm a few days late, but last week's haul for VulnCheck Initial Access Intelligence customers included new #exploits, detections, PCAPs, and more for Tenda AC15 AC1900 devices, Flowise, and LG Simple Editor. The team also shipped a scanner for F5 BIG-IP management interfaces (plus ASM queries) and signatures for Redis CVE-2025-46818 (privesc) and CVE-2025-49844 (use-after-free). Notably, despite the news cycle, none of the public PoC for Redis manages to successfully trigger a crash, let alone get code execution. VulnCheck's research team assesses that the UAF is unlikely to be exploitable at scale, which isn't super surprising. More details and #threat context in the team's release notes! https://lnkd.in/ezJb-FXq
29
-
Hassaan Ali Bukhari .
ACM Student GIKI Chapter • 687 followers
Just published a full step-by-step walkthrough on Rooting the Butler machine (TCM Security). This write-up covers the complete attack path — from initial enumeration to privilege escalation. If you’re preparing for hands-on certifications or sharpening real-world pentesting skills, this one’s for you.
15
1 Comment -
Alexandre Dulaunoy
OASIS • 6K followers
After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV). Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program
145
11 Comments -
Pravesh Gaonjur
TYLERS • 4K followers
Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers
17
2 Comments -
Taylor Walton
SOCFortress • 3K followers
You might be feeling frustrated by the endless struggle of getting Sigma detection rules to work seamlessly in your open-source SIEM stack. It probably feels like every new rule demands manual conversions, special configs, and a ton of guesswork. It can be exhausting--and I’ve definitely been there. In this walkthrough I introduce how we can incorporate Velociraptor DFIR to solve our Sigma challenge. I share how I set up automated scans, tackled noisy detections, and fed alerts into my incident-response workflow (CoPilot). https://lnkd.in/gX5-X_mN
90
3 Comments -
Yew Kuann CHENG (YK)
PCI Security Standards Council • 5K followers
𝗧𝗵𝗲 𝗦𝘁𝗮𝘁𝗲 𝗼𝗳 𝗶𝗙𝗿𝗮𝗺𝗲 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 iFrame is a common webpage component used to display payment pages from the acquirer, payment facilitator or payment gateway. In an interesting article by Abigail Amadi from Jscrambler, she outlined the common methods of attacking iFrames, how it relates to PCI DSS and what you can do about it. https://lnkd.in/gF2VwYB3 In my second last article featuring sponsors at the PCI Europe and Asia Pacific Community Meetings, thank you to Pedro Fortuna, John Elliott and the Jscrambler team for being sponsors at the PCI EUCM. Pedro and John also represent Jscrambler as a PCI Principal Participating Organization (the higher tier member) and a PCI Board of Advisors member. I have covered about this issue with merchants’ page scripts in earlier posts. https://lnkd.in/ggF-gETE and https://lnkd.in/gkrr_MmV If you are a larger eCommerce (CNP) merchant and have no idea how to address this, do consider attending the PCI Community Meetings where experts will be present to demonstrate what the problem is. There are two more conferences (Amsterdam from 14-16 Oct, Bangkok from 5-6 Nov) so make use of this opportunity to learn how to protect your organization's reputation and your customers' sensitive payment data. https://lnkd.in/gNbE4wHH Smaller merchants are welcomed to join the Community Meetings but you should consult your Compliance Accepting Entity(ies), which is likely your acquirer (merchant bank), on suitable actions. You may also refer to this information supplement published on the PCI Perspectives Blog: https://lnkd.in/g3BFxAEH Disclaimer: PCI Council is a neutral body and my personal post is not an endorsement of any organization or solution. PCI Security Standards Council #pcissc #pcicommunity #pcidss #pcidssv4 #datasecurity #cybersecurity #payments #paymentsecurity Video credit: Thank you Canva for your platform and the royalty-free video.
21
-
Jon Hencinski
Prophet Security • 5K followers
Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM
77
-
Darace Rose
Oppos • 12K followers
Achieving SOC 2 compliance can be complex—but it doesn’t have to be. Oppos offers full-spectrum SOC 2 compliance & attestation services designed for businesses that value security, trust, and audit readiness. ✅ Start with a scoping and gap assessment to identify where you stand ✅ Document policies and controls aligned with SOC 2 Trust Services Criteria ✅ Conduct internal testing and advisory support ✅ Guide you through auditor validation and formal attestation Our approach helps streamline the process—reduce audit delays, prove trust to clients, and support growth in regulated markets. Whether you’re pursuing your first attestation or maintaining certification annually, we bring clarity, structure, and speed. https://smpl.is/aa7rd #SOC2 #ComplianceServices #AuditReady
9
-
Gerald Auger, Ph.D.
Simply Cyber • 79K followers
⚙️ NEW EPISODE: Simply ICS Cyber – LIVE & ON DEMAND today at 9:30 AM EDT! Industrial cybersecurity and incident response fans — this one’s for you. 🎙️ S1 E5: Incident Response in ICS, OT, SCADA is with special guest Kai Thomsen, Director of Global IR Services at Dragos. In this must-hear episode, Don and Tom sit down with Kai to pull back the curtain on what Incident Response really looks like in ICS, OT, and SCADA environments. We’re digging into questions like: 🔹 Is DFIR the same in OT as it is in IT? 🔹 Who actually owns incident response in OT? 🔹 What makes tabletop exercises so critical — and how do you run them? 🔹 How can YOU break into OT-focused DFIR? 🚨 Whether you're defending control systems, building OT programs, or pivoting from IT to industrial cyber, this episode delivers tactical insights you won’t get anywhere else. 📺 Watch the stream on YouTube or 🎧 Catch the podcast on all major platforms 📅 Streaming Wednesday, April 16 at 9:30 AM EDT 🔗 youtu.be/qWsNbcqJX8M #ICS #incidentresponse #cybersecurity
9
-
Troy Fine
Fine Assurance • 40K followers
Misinformation is circulating that Microsoft has stopped accepting SOC 2 reports for its SSPA program. This is incorrect. The April 2025 SSPA program guide states “A SOC 2 report may be accepted for DPR Section J (security) where no qualifications are noted." However, it is correct that SSPA may require SaaS companies to obtain an ISO 27001 and/or an ISO 42001 certification depending on a SaaS company’s agreement with Microsoft. They do not require SaaS companies to obtain an Unqualified SOC 2 report in any circumstances. But this doesn’t mean that Microsoft’s SSPA program won’t accept SOC 2 as evidence of meeting security requirements. An unqualified SOC 2 report is still a valid and valuable way to demonstrate your security posture to Microsoft and other customers. Don't let these rumors diminish the credibility of SOC 2 reports.
59
7 Comments -
Kishan Gondaliya
University Hospitals Dorset… • 5K followers
Stop Calling It “User Error” — Start Calling It a Design Flaw We’ve trained people to blame themselves for security failures. Clicked a phishing link? Didn’t spot the fake invoice? Used the same password twice? We call it user error -- when the real error is designing systems that expect perfection from humans under pressure. Cybersecurity shouldn’t rely on luck or fear. It should be built with empathy. Security is a shared right -- not a solo burden. How are you designing cyber programs that support humans, not punish them? #HumanCenteredSecurity #EmpathyInCyber #infosec #NoMoreUserError
13
7 Comments -
Gareth Bowker
1K followers
I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...
54
17 Comments
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top contentAdd new skills with these courses
-
13m
A Standalone Project: Build a Program to Encrypt and Decrypt Text Messages Using an Encryption Algorithm to Protect Data from Unauthorized Access
-
2h 3m
Threat Hunting Deep Dive: Intelligence-Based Detection and Response Strategies
-
2h 9m
Modern Threat Hunting Strategies to Identify Attacks