Jonathan M. Herman

Award-Winning Innovator, Technologist & Disruptor in Artificial Intelligence, Mixed Reality & Blockchain

[Jonathan M. Herman @JMH_Strong]

As #AI models become more powerful, they also present growing cyber security risks - therefore I’m excited to share that I’ve joined Cyber Realm Solutions as an #AI #Consultant to support their initiatives.

National Law Review Coverage - https://t.co/s1YM8bMuS4

[Jonathan M. Herman @JMH_Strong]

Thank you #Crunchbase for currently ranking me among the Top 100 #CEOs globally! It's an honor to be recognized for my work with #integrated #technologies - #AI, #Blockchain & #Mixed #Reality

https://t.co/X11rmubVLQ

#ArtificialIntelligence #Tokenization #AR #XR

[Jonathan M. Herman @JMH_Strong]

Sovereign AI = who owns the weights, where inference runs, what data leaves the perimeter.

Secure AI's next wave is the model you can run inside your own walls.

https://t.co/WEbW20r5Z3

#ArtificialIntelligence #Cybersecurity #CriticalInfrastructure #AI #Innovation

[Jonathan M. Herman @JMH_Strong]

The White House just signed an EO pushing AI labs to give the government early access to their most powerful models — plus a federal clearinghouse to scan critical infrastructure for vulnerabilities.

A real step. But it raises a harder question for operators 👇

[Jonathan M. Herman @JMH_Strong]

The most sensitive systems — nuclear, grid OT, water, defense — can't connect production networks to a cloud AI API. By architecture and by rule.

Defensive AI only counts if it runs where the threat is. For air-gapped environments, that means on-prem. Sovereign by design.

[Jonathan M. Herman @JMH_Strong]

Secure local AI flips the default — model inside your boundary, data never leaves, the audit line is yours. The question isn't whether to adopt AI. It's where it runs. https://t.co/JkUqeLs42R #Cybersecurity #AI #RiskManagement #DigitalTransformation #EnterpriseAI

[Jonathan M. Herman @JMH_Strong]

OpenAI just confirmed two developer machines compromised in a supply-chain attack this week. Reminder: cloud AI means your threat model now includes the provider's pipeline, their dependencies, and their incident timeline — not just yours.

[Jonathan M. Herman @JMH_Strong]

For regulated operators (energy, water, nuclear, finance, healthcare) ask 3 things: Where does inference run? What's in the upstream supply chain you can't see or patch? What happens to YOU when the provider has a bad day? If you can't answer, you don't control your AI.

[Jonathan M. Herman @JMH_Strong]

If your AI roadmap doesn't account for both the policy gap and the new attacker capability, it's time to talk.

https://t.co/JkUqeLs42R

#Cybersecurity #AI #RiskManagement#DigitalTransformation #EnterpriseAI

#Cybersecurity #AI #RiskManagement #DigitalTransformation #EnterpriseAI

[Jonathan M. Herman @JMH_Strong]

Two stories from the last 10 days tell critical-infrastructure operators everything about the gap between regulation and reality.

May 21: White House pulled the AI cybersecurity EO.
May 12: Dragos published the first AI-assisted attack postmortem. Water utility. Claude+GPT recon

[Jonathan M. Herman @JMH_Strong]

Operator takeaway:
1) Federal benchmark on hold. The threat that motivated it isn't.
2) AI-assisted recon on regulated networks no longer needs a nation-state. Commercial LLMs lower the floor.
3) Air-gapped inference + segmentation are now preconditions, not hedges.

[Strong Interactive @Strong_Interact]

Brand discovery is shifting from search engines to #AI #Agents. They answer from the Semantic Web — knowledge graphs and structured entities, not your homepage. If your company isn't well-formed there, you're invisible to #AEO (Answer Engine Optimization).

[Jonathan M. Herman @JMH_Strong]

Air-gapped AI = weights local, inference local, data never leaves the boundary, model under change control. Most "private AI" fails every test, regardless of sector. If you can't air-gap it, you can't audit it. https://t.co/JkUqeLs42R

[Jonathan M. Herman @JMH_Strong]

IAEA closed CyberCon26 Friday + launched a Coordinated Research Project on computer security for AI in regulated environments. When the world's most exacting safety regulator decides AI needs its own security framework, every regulated industry should be reading the same memo.

[Jonathan M. Herman @JMH_Strong]

New Kiteworks forecast: 91% of energy orgs lack network isolation for AI. 59% don't encrypt training data. 51% still run manual incident response. Same picture in healthcare, finance, government. Not an AI maturity gap — a perimeter problem with AI poured into it.

[Jonathan M. Herman @JMH_Strong]

Infrastructure is named as a first-class cluster — hardware, network boundaries, isolation.

That's the policy hook for sovereign and air-gapped AI to move from preference to procurement requirement.

More: https://t.co/JkUqeLs42R

[Jonathan M. Herman @JMH_Strong]

CISA and the G7 just published an SBOM standard for AI.

It dropped May 12 and barely registered — but if you operate or buy AI in a regulated environment, it's the document that just reshaped your compliance frontier.

[Jonathan M. Herman @JMH_Strong]

Seven minimum-element clusters: Metadata, Models, Dataset Properties, System Level Properties, KPIs, Security Properties, Infrastructure.

Provenance is no longer a vendor talking point. The dependency graph is becoming legible the way open source did a decade ago.

[Jonathan M. Herman @JMH_Strong]

CI Fortify will push operators to prove recovery without dependencies. AI dependencies count.

The organizations getting this right aren't the loudest. They're quietly architecting for control.

More: https://t.co/JkUqeLs42R

[Jonathan M. Herman @JMH_Strong]

Two stories landed this week and they should be read together:

1) CISA launched CI Fortify — preparing critical infrastructure for cyber outages during geopolitical conflict.
2) The House opened an inquiry into PRC-origin AI models in U.S. critical infrastructure.

[Jonathan M. Herman @JMH_Strong]

Read together they describe the same problem: AI is now inside the perimeter of systems we cannot afford to lose.

Sovereignty becomes architectural, not legal. You don't get sovereign AI from a procurement clause. You get it from where the model actually runs.