Robert Pritchard

Cyber security nerd. Former UK gov cyber security. Security consultant & capacity builder. RUSI Associate Fellow. Creator of Soothsayer

[Robert Pritchard @TheCyberSecExp]

@AccidentalCISO Fair. I do think there is a lot of grumbling in security though. I think it’s less about educating and more about doing. We need to see the end of security as a seperate function (largely anyway) and much more embedded into operational functions

[Robert Pritchard @TheCyberSecExp]

I don’t entirely disagree with this but I do disagree with the displaced blame. This is a failing of us as security professionals and industry. Too distant from the core business,tookeen on our own budgets and large teams instead of embedding these things across operational teams

[Accidental CISO @AccidentalCISO]

An uncomfortable truth in our field is that as long as C suite execs and boards overwhelmingly view their security programs and audits as checkbox activities to drive sales rather than business aligned risk management activities, we will never solve the security theater problem.

[Robert Pritchard @TheCyberSecExp]

@UK_Daniel_Card

[Robert Pritchard @TheCyberSecExp]

Harsh.

[Encyclopaedia Britannica @Britannica]

MTV debuted closer to Pearl Harbor than to today.

[Robert Pritchard @TheCyberSecExp]

@UK_Daniel_Card take it easy

[Tom Chivers @TomChivers]

Excellent by @aljwhite on the difficulty of doing reporting on Russell Brand despite years of rumour and allegation https://t.co/P46XQrTDlb

[Robert Pritchard @TheCyberSecExp]

@rowlsmanthorpe The thing is sensible people have been saying that for years. There was a belief that somehow got spun out about ‘cyber war’ that had no basis in reality

[Robert Pritchard @TheCyberSecExp]

@halvarflake He's barking. And so's she. Very bad outlook.

[Robert Pritchard @TheCyberSecExp]

@UK_Daniel_Card @Anker_Charging Nice. Looks cool

[Stefan Esser @i0n1c]

The believe that you just point a model at an iPhone and it will spit out a jailbreak is just wrong. Without humans that keep track and guide the models you are not going to get good results. Security research is very much alive. And human knowledge is still important

[Robert Pritchard @TheCyberSecExp]

@UK_Daniel_Card Sorry dude that sucks. In better news I woke up at a similar time to news of my nephew being born. Waiting on photos.

[Robert Pritchard @TheCyberSecExp]

@UK_Daniel_Card They're incredibly noisy - I had first had experience recently (and posted about it yesterday).

[Robert Pritchard @TheCyberSecExp]

and even when they are successful with an exploit, they are not focussed. So yes machine speed - but you still have time to respond. Monitoring and alerting AND responding to those is more important than ever. It's not a lost fight - defenders can move quickly too.

[Robert Pritchard @TheCyberSecExp]

I had direct experience of one of these frameworks recently. I will say they are fast and find effective vulnerabilities quickly. But, in my experience at least, they are fast at trying lots of ineffective things too, and generate a great deal of noise. Literally nothing subtle

[Choblin @choblin29]

Holy Shit. In a new critical advisory issued TODAY, India's cyber agency CERT-In says hackers are using AI-assisted tools to attack financial institutions, exploiting payment APIs and testing transfers with just ₹1 before moving larger sums.

CERT-In identifies the group as CRAFTY FALCON and says it is using FOUR publicly available AI offensive-security systems: ARTEX, PentAGI, Cairn and CyberStrikeAI.

The campaign is still succeeding against fintechs and NBFCs, including firms that had already been warned and attempted remediation. Some were deliberately targeted AGAIN, while attackers are timing intrusions around weekends and holidays when security monitoring is lower.

[Robert Pritchard @TheCyberSecExp]

@mikenelson586 I had to ask Grok to explain that for me, and tbh I'm still none the wiser.

[log4j @log4j]

“excellent, now say we cover dental”

[Old Gassy @OldGassy1984]

The supermarket chain thaw massacre

[Robert Pritchard @TheCyberSecExp]

@KGeorgee @rowlsmanthorpe I haven't even had codex summarise it for me yet

[mRr3b00t @UK_Daniel_Card]

please please please understand that using LLMs for forensics etc. can be a major problemo!

not just forensics but generally using them for well.... anything.....