James Berthoty

CEO of Latio, the best place to understand the cyber security market.

[James Berthoty @JamesBerthoty]

@madelinelawren talk about using k9 to manage k8s running k3s

[James Berthoty @JamesBerthoty]

@IceSolst Ya attackers only have to be right once really changes when it involves law enforcement

[James Berthoty @JamesBerthoty]

❌C̶l̶o̶u̶d̶ ̶d̶e̶v̶e̶l̶o̶p̶e̶r̶ ̶s̶a̶n̶d̶b̶o̶x̶e̶s̶
✅ Software Factories

Gotta keep it trendy

[James Berthoty @JamesBerthoty]

@IceSolst Their emails are unbelievably thoroughly summarized

[James Berthoty @JamesBerthoty]

@IceSolst @sausage_noods Appreciate you, I'm trying to get the tweets in more lol

[James Berthoty @JamesBerthoty]

Lots of rumors around PANW acquiring NHI Security tool Clutch Security - I think it makes sense. NHI tools provide a ton of value, but struggle to get budgeted priority. Mapping token access is key to reducing AI risk, and increasingly supply chain attacks.

[James Berthoty @JamesBerthoty]

@anton_chuvakin I think a lot of the miss-emphasis here is because a lot of the first wave AI products were proxy based prompt injection detectors without a concept of assets, posture, users, etc.

[James Berthoty @JamesBerthoty]

@IceSolst Have you tried putting "make no mistakes" in the human tickets too?

[James Berthoty @JamesBerthoty]

@NeoRusII The low hanging fruit answer is doing a 7 day package delay as a global config, but there are more complicated & foolproof answers like package registry proxies ("package firewalls") and newer endpoint solutions that can properly monitor packages.

[James Berthoty @JamesBerthoty]

The Litellm supply chain malware attack provides several actionable items for defenders to implement today, here’s what happened:

1. An attacker gained initial access to an internal platform from a publicly committed secret that was deleted from source code but never rotated.

2. They used over-permissioned GitHub OAuth credentials to slowly take over the environment and collect keys, ultimately pointing the release at their malicious fork

3. They attempted to cover their tracks by deleting workflow logs and force pushing over malicious commits.

Here’s what teams can do about these kinds of attacks:

1. Have a defined secret remediation process. Combine pre-commit secret scanning with documented key rotation and revocation procedures. Deleting a leaked secret isn't enough.

2. Monitor GitHub platform audit logs. Alert on sensitive actions such as branch protection overrides, unexpected force pushes, and deleted workflow runs.

3. Monitor CI/CD runners. Log runner activity and, where possible, implement runtime network egress monitoring to detect suspicious outbound connections.

[James Berthoty @JamesBerthoty]

I think maybe the conflation is best product != the one that does the most for security. To use the SaaS example, the posture stuff can be a "better product" because it more effectively meets teams where they're at, even if OAuth runtime protection would move the needle more for prevention

[James Berthoty @JamesBerthoty]

I think that marketing and sales do matter more than people think in cyber, but the best product usually wins. The cybersecurity community is anything but shy about blasting subpar product performance, and you can't build a great brand against a great product.

[Shreya Shekhar @_shreya_s]

Cybersecurity is an industry where historically, the best product has rarely won.

In a world of human-constrained attacks, cyber was still effectively a checkbox. As long as the product met a baseline functionality, the CISO said, “I have my VM/SIEM/DLP solution, I’m good to go.” In this paradigm, marketing and sales mattered way more than technical superiority.

But in a world where agents can attack your systems at massive volume and scale, the efficacy of cybersecurity products is put to the test. Even a difference of 96% vs 99% in attack prevention is magnified. Brittle solutions which can’t perform at scale will quickly be ousted and we’ll see companies that grew purely on marketing and Gartner magic quadrants sink quickly.

The cyber industry is changing, and now the best technology will win.

[James Berthoty @JamesBerthoty]

It looked like more a movement about 6 months ago, but the prevention without a CVE moment is imo more top of mind for now. ADR is also good at that use case, but crowdstrike calling AIDR for AI on end user devices, and that being the main use case at the moment, I think delays it

[James Berthoty @JamesBerthoty]

Virtual patching, ADR, RASP, mitigation is pretty hot right now 🔥 If you want a primer, this blog from 2 years ago is still pretty relevant: https://t.co/VZ6VidRiC8

[James Berthoty @JamesBerthoty]

For sure, tools are really just function executions. I would also extend this to some of the experimentation with tracking intent across sessions, as well as how lacking enterprise endpoint governance controls are in general - MDMs just don't give teams the control they need in authorizing things like packages and extensions.

[James Berthoty @JamesBerthoty]

Sharing our article from last year on how to secure developer endpoints - the Binance incident is just the latest in a long overlooked string of attacks against the biggest endpoint blindspot: developer laptops. Glad to see a ton of industry investment here post Koi acquisition, EDR is not enough.

https://t.co/pL12Twvxs0

[James Berthoty @JamesBerthoty]

@IceSolst Maybe the devops laptop had a public facing PHP app 🧠

[James Berthoty @JamesBerthoty]

The cybersecurity industry has at least four perspectives that are usually in some kind of conflict:

1. Developers and platform engineers who think most things are simple, wonder why the industry is always freaking out, and love building their own solutions

2. Practitioners at large, usually non-tech first, organizations who are trying manage and implement scalable programs, doing their best to make marginal improvements

3. CISOs or other executives trying to react correctly to the right trends, fighting for budget and political capital

4. Vendors trying to balance serving their customers and generating demand, but doing so in an industry that thrives on skepticism

A fun game is cross correlating these personas to social media platforms and events