Mark Simos

Lead Cybersecurity Architect • Executive and Board Advisor • Keynote Speaker • Professional Storyteller

[Mark Simos @MarkSimos]

My new video on Security Operations (SecOps/SOC) just dropped!
​
I cover all the important aspect of SecOps including how AI does 𝘢̲𝘯̲𝘥̲ 𝘥̲𝘰̲𝘦̲𝘴̲𝘯̲'̲𝘵̲ change SecOps.
​
Share and Enjoy!
​
https://t.co/dmc0bQP4vD

[Mark Simos @MarkSimos]

5/5

And please stop treating MTTD as the primary measure of SOC success.

It tells you how quickly you knew you had a problem.

Not how quickly you solved the problem.

MTTR also needs everyone to agree on exactly what starts and stops the clock.

[Mark Simos @MarkSimos]

EVENT ≠ ALERT ≠ DETECTION ≠ INCIDENT ≠ COMPROMISE ≠ BREACH

THREAT DATA ≠ THREAT INTELLIGENCE

These aren't interchangeable. Words matter.

Just posted an article - https://t.co/NKW8FQIyxf

about the new glossary version being released -
https://t.co/T9lPDlNyz1

[Mark Simos @MarkSimos]

4/5

RESPONSIBILITY ≠ ACCOUNTABILITY

Responsibility = an obligation to perform duties.

Accountability = ownership of the impact and outcome.

Multiple parties can legitimately have responsibilities.

But shared responsibility should not mean shared ambiguity.

[Mark Simos @MarkSimos]

The goal isn't to turn executives into security experts. It's to give them enough understanding to make good decisions about risk, priorities, and investment.

https://t.co/7avGR3brQT

[Mark Simos @MarkSimos]

Are you talking to business leaders in their language? or yours?

We just added guidance to Microsoft SAF on engaging business leaders on security strategy, including some practical executive communication techniques I've found useful over the years.

https://t.co/7avGR3bZGr

[Mark Simos @MarkSimos]

Communicating effectively means keeping it simple without pretending the complexity isn't there.

- Avoid security jargon when business or risk language works better.
- Use analogies people already understand.
- Connect to what each leader is actually responsible for.

[Mark Simos @MarkSimos]

That's why we added a new "Using SAF effectively" guide to Microsoft Learn: to help you find the right entry point and start stitching the work together.

The wrong choice is waiting to start.

https://t.co/W11igSZsvH

[Mark Simos @MarkSimos]

Is AI forcing you to move faster on your Zero Trust journey?
It should be.

[Mark Simos @MarkSimos]

The good news: there isn't one "right" place to start.
Different organizations have different priorities, risks, technologies, and levels of maturity.
Start where you can make meaningful progress, then connect that work to the bigger picture.

[Mark Simos @MarkSimos]

There’s a lot of nuance between security and compliance (and opinions, misunderstandings, & debates)

We tried to unpack these in this Microsoft Security guidance. Feedback welcome!

https://t.co/979ToCkGGq

We’re also adding more mappings. What should we prioritize next?

[Mark Simos @MarkSimos]

I was recently on campus at Redmond and couldn't remember which building the meeting was in.

If you have kids, you will understand 🤣

[Mark Simos @MarkSimos]

@orinthomas Yeah, I think we neglected the humanities (WHY) a bit in the fervor for the STEM stuff (HOW)

Both are necessary to create a complete skillset/perspective (as well as respect for people whose skills/opinions/etc. differ from yours)

[Mark Simos @MarkSimos]

Use AI to make you smarter, not dumber.

When I said this line to a college class in a guest lecture, I got an amazingly simple and powerful question back from one of the students - How do I do that?

This led me to start writing down my thoughts and experiences

Thread ⬇️

[Mark Simos @MarkSimos]

I am very interested in your feedback - are you doing something similar? Something else?

What would you add, change, or challenge?

[Mark Simos @MarkSimos]

4. Check on how AI is learning to interact with me.
I regularly ask AI to summarize what it thinks about me, including my preferences, patterns, and assumptions so I can review it, consider it, and edit as needed.
⬇️