The Decade-Old Bug Is Now a One-Week Find
AI vulnerability discovery is turning years-old bugs in PHP and Linux into week-long finds. What old code you expose, who owns it, and a checklist.
Writing · Tag
Posts tagged vCISO
9 posts on vCISO. Or browse the full writing index →
Posts tagged vCISO
php2shell: What to Do if Your Servers Run PHP
Two critical PHP flaws, php2shell, got fixed on Oct 21. A triage order for anyone with PHP on a server: inventory, patch and restart, mitigate, isolate.
Your Personal Brand Is an Attack Surface
Every talk, bio, and commit you publish to build a name is also recon and impersonation fuel. A vCISO's founder-scale checklist for hardening your identity.
Detection Got Cheap. Remediation Didn't.
Microsoft just made vulnerability detection cheaper and more accurate. For a 12-40 person AI startup, that was never the bottleneck.
Shadow AI at a Startup That Can't Buy a CASB
The enterprise shadow-AI playbook assumes a CASB budget you don't have. Here's the free, no-blame version for a 5-15 person team: three steps, zero procurement.
Security Engineer or vCISO? Your First Hire, by Stage
A security engineer builds and a vCISO decides. Which one your startup needs first, stage by stage, and the cases where the answer is neither.
What 90 Days of a Fractional Security Engagement Actually Looks Like
Most founders who book the intro call have already read three or four of my posts and arrive at the same question: "Okay, but what would the next 90 days actually look like if I hired you?" Here's the answer, week by week, with the real numbers.
vCISO Math for AI Founders: Why 5 Hours a Month Beats a Full-Time Hire
A full-time CISO costs $200–400K plus equity. A vCISO costs $2–4K a month and gives you 80% of the value at 5% of the burn, until you outgrow them. The math, the deliverables to expect, and the red flags that mean you've hired the wrong one.
How I Triage a New Codebase in 90 Minutes
A fractional engineering engagement starts with a codebase you've never seen. You have ninety minutes to form a useful POV before the kickoff call. The seven-step triage I run, the two questions I bring back to the founder, and how AI tooling has accelerated the process.