Nicholas DiCola

VP @ZeroNetworks | Former @Microsoft | Retired @USMC. Author, Gamer, Classic Car Enthusiast and all around Techie / Security Human.

[Nicholas DiCola @MasterSecJedi]

All this talk of “machine speed”.

Had to go see real machine speed!!

Happy Friday!

[Nicholas DiCola @MasterSecJedi]

@anton_chuvakin Look it’s partially right. If you limit at the network layer what agents can do than you can move up to identity/app/data for the places you do allow it to talk. Industry calls is agent security but its concept is called zero trust.

[Nicholas DiCola @MasterSecJedi]

@Paddyotg @AmericanAir Geez. what a crock

[Nicholas DiCola @MasterSecJedi]

@AmericanAir you are doing a terrible job today. Canceled flight and everyone is standing in 1 line to check in luggage 🧳 and everyone has to go to the agent cause the bags are on limbo… wtf.

[Nicholas DiCola @MasterSecJedi]

@AmericanAir It’s like this never happens…..

[Nicholas DiCola @MasterSecJedi]

@AmericanAir Won’t help. The problem is being understaffed and unprepared when flights are canceled.

[Nicholas DiCola @MasterSecJedi]

@MarkSimos but they cant measure the business impact of cyber cause risk (likelihood and impact) is not easily measured until it happens.
So business will always opt for keep the business up and accept the risk but patch "safely"
safely = slowly , dev -> test-> prod etc.

[Nicholas DiCola @MasterSecJedi]

@MarkSimos Im still debating in my head "patching speed". you know well as i do this has never improved since we both were on the same team.
i think its risky for the business due to potential breaking an application so they wont patch fast cause they can measure that risk

[Nicholas DiCola @MasterSecJedi]

Great read, but Im still worried the industry is over focused on detection and response which isnt going to solve this ...... much to do.....

[a16z @a16z]

In a single year, AI has rewritten the security priority list for CISOs.

Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.

There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.

In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.

The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)

Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)

From a16z's @OwenColby and @steph_zhang on The New Security Agenda: https://t.co/C814PJ4wGg

[Zero Networks @ZeroNetworks]

If you had to break into cybersecurity today, how would you do it? 👀

CISO Series asked seasoned security pros at Black Hat 2026. They agreed it's harder now, since AI is absorbing a lot of entry-level work. Here's what they'd do: 

📚 Build a portfolio now. Follow the leaders you admire, comment, and publish your own takes. 

Use the free training that's out there. Break things so you learn how to fix them. 

Learn the fundamentals, like risk and assurance, and start on the help desk to build troubleshooting skills. 

Then use AI to do more of the work you enjoy. The workflows that never scaled are where cyber is being rebuilt. 

What would you add? 👇 

#Cybersecurity #CyberCareers #BlackHat #InfoSec @CISOSeries

[Nicholas DiCola @MasterSecJedi]

@MarkSimos No I’m saying it’s too risky for a business to “patch faster”. There are other proactive things that can help protect with all these vulns
I’m saying focus on what’s achieveable

[Nicholas DiCola @MasterSecJedi]

Another example proving #microsegmentation is a must these days. I’ll just keep saying it til we all do it. :)

[Dr. Anton Chuvakin @anton_chuvakin]

One lesson from @unpromptedconf so far: because it is dead obvious that attacker automation runs much faster than any automated remediation/response, defenders should refuse the speed race and focus on invariants.

[Dr. Anton Chuvakin @anton_chuvakin]

One lesson from @unpromptedconf so far: because it is dead obvious that attacker automation runs much faster than any automated remediation/response, defenders should refuse the speed race and focus on invariants.

[Zero Networks @ZeroNetworks]

We set Claude loose on our network.

It got in. It got admin. It got credentials.

Then it got nowhere.

As part of Anthropic’s Cyber Verification Program, we deployed a frontier AI model as an autonomous attacker inside a production-grade lab running Windows, Linux, macOS and Kubernetes. One machine was left unsegmented on purpose.

Claude owned that machine. Then it threw everything it had at the rest of the network:
→ 18 attack paths
→ 23 offensive tools
→ 22 MITRE ATT&CK techniques, including Kerberoasting, AD credential extraction and Pass-the-Hash

Lateral movement: zero.

In some runs, it recognized the network was segmented by Zero Networks, and quit attacking.

AI makes the attacker faster. Segmentation makes faster irrelevant.

Read the PR here: https://t.co/QHxRZyYl7N
#AISecurity #Microsegmentation #ZeroTrust #Cybersecurity

[Nicholas DiCola @MasterSecJedi]

@ItsStella_4 Yes

[Zero Networks @ZeroNetworks]

Reporting on MTTD or alert volume won’t dismantle the language barrier between CISOs and business leaders.  

Containment metrics bridge the gap by showing how resilient the business is against worst-case scenario cyber threats.  

Zero’s Cyber Resilience Toolkit for CISOs provides a step-by-step framework for assessing your current posture and building a business-aligned strategy for strengthening cyber resilience, plus a customizable deck for reporting the findings that actually matter at the board level. 

📍Get the toolkit ➡ https://t.co/sKzG1fzZx0 

#CyberResilience #Cybersecurity #CISO

[Zero Networks @ZeroNetworks]

@nich

[Nicholas DiCola @MasterSecJedi]

@anton_chuvakin I call it agent if you install something
If some remotes in and runs a script that’s not an agent.

[Zero Networks @ZeroNetworks]

New machine joins the network? It's segmented automatically. No tickets, no manual rules. 

"We allow what we allow and everything else is locked down." 

We apply the same logic to AI: control what agents can reach and contain AI-driven attacks before they spread. 

See it for yourself → https://t.co/79au6MsJoy