Michael Sitler

CEO at Sectri. Strengthening National Cyber Resilience.

[Paul Graham @paulg]

"Literally from a hospital bed, he was telling me bugs."

— Matt Mullenweg on Om

[Michael Sitler @msitler]

@bettersafetynet I just registered for a federal treasury account this morning and had exactly the same thought.

[spencer @techspence]

If AI helps us accomplish one thing in cybersecurity, I hope it’s that it helps leadership realize you cannot intentionally underinvest in people & technology and also maintain a strong security program.

[Michael Sitler @msitler]

Maybe this doesn't apply to everyone, but for me this couldn't be more true.

When we're healthy:
We eat nutritious food.
We track what we eat.
We measure our progress at the gym.
We weigh ourselves every day.

When we're unhealthy:
We eat nutritious food sometimes.
We track what we eat on good days.
We go through the motions at the gym.
We rarely weigh ourselves.

Being healthy requires making intentional effort, measuring progress, and taking ownership of the outcome.

When we just go through the motions and avoid measuring our progress because it makes us feel bad, we're likely on a downward slope toward an unhealthy lifestyle and all of the consequences that come with that.

This applies to our occupational health as well, especially if we're in a leadership position. If we're not making intentional effort, measuring progress, and taking ownership of the outcome, we'll eventually face the consequences.

[Michael Sitler @msitler]

Most cybersecurity breaches occur because organizations fail to implement governance, oversight, and accountability for cybersecurity risk.

NSPM-12 establishes a new cybersecurity governance framework that requires National Security Systems (NSS) to meet or exceed cybersecurity standards issued by the National Institute of Standards and Technology (NIST).

https://t.co/VUiC5fKo71

[Michael Sitler @msitler]

Ransomware attacks are on the rise. Education was targeted more than any other industry, averaging 4,641 weekly attacks per organization. Government and telecom were next in line.

https://t.co/Xw7Qv4QIJ7

[Michael Sitler @msitler]

Collaboration in cybersecurity has never been more critical than it is today, especially for less resourced organizations like state and local governments.

We founded Sectri and built our cybersecurity program management platform around that concept. Our Alliance of critical infrastructure customers collaborate with one another and benchmark against each other 24x7x365 on the Sectri Platform and they meet monthly to learn about the latest threats facing their sectors, discuss hot topics, and perform tabletop exercises.

If you're interested in potentially joining a cohort of peers in your sector, send me a DM and we'll connect.

https://t.co/yG1iOYtigK

[Michael Sitler @msitler]

According to CISA’s latest directive, patching should be prioritized based on four things: is the asset exposed, is it on the KEV list, can exploitation be automated, and how bad is it if someone exploits the vulnerability.
https://t.co/sObM6VDAbj

[Michael Sitler @msitler]

One of the most important vulnerability lists to monitor is CISA's Known Exploited Vulnerabilities (KEV) catalog, because it identifies severe vulnerabilities that are being actively exploited in the real world.

If you're not already monitoring this list, you can easily sign-up to receive email notifications when new vulnerabilities are added to the catalog. For small IT teams with limited security capabilities, these alerts may provide you with enough time to act before a severe vulnerability is exploited in your organization.

https://t.co/UqoY69gWGH

[Michael Sitler @msitler]

Another school district gets an unplanned long weekend because of a ransomware attack. Unfortunately, it's been a rough start for K-12 in 2026.

Ransomware groups are typically opportunistic, meaning they attack the vulnerable rather than going after specific organizations. If districts spend more time strengthening their cyber resilience and minimizing vulnerabilities, they're much less likely to experience the type of outage that requires closure.

It's either that or districts may need to start adding a few pre-planned "ransomware days" onto the school calendar each year like they do for "snow days" in the northern US...

[Michael Sitler @msitler]

I saw the news about Anthropic's upcoming IPO and it got me thinking about what a great business model they've come up with...

[Michael Sitler @msitler]

The Public Sector Cybersecurity Summit kicks off tomorrow (6/2) at 1pm Eastern, 4pm Pacific. Approvals are reviewed manually, so don't wait until the last minute to register. Hope to see you there!

[Sectri @SectriSecurity]

Are you a public sector IT or cybersecurity leader? Join us tomorrow for a virtual, peer-driven cybersecurity summit with cities, counties, states, school districts, and other U.S. critical infrastructure agencies.

https://t.co/sn82dgMuhg

[Michael Sitler @msitler]

@eugeneychan Who needs humans when you can use AI to create your entire cybersecurity policy set "in under 60 seconds, tailored to your company"... Saw that one yesterday and it made me laugh out loud.

[Michael Sitler @msitler]

AI agents are awesome and automation is amazing, but cyber governance and risk management cannot be fully automated. Anyone telling you otherwise is selling you snake oil.

[Michael Sitler @msitler]

Really looking forward to this event next week. It's always fun when attendees drive the agenda and topics being discussed. We'll follow Chatham House Rule and the event will not be recorded.

[Sectri @SectriSecurity]

Next week, Sectri is hosting a virtual Public Sector Cybersecurity Summit focused on real incidents, lessons learned, and practical strategies for strengthening cybersecurity programs.

Join public sector IT and security leaders from across the country for a transparent, peer-driven discussion.

View the agenda and request an invitation below.

https://t.co/Ho3ptFsKuo

[Michael Sitler @msitler]

"The last 6,000 years reads like this: Opportunity mixed with difficulty." Jim Rohn said that decades ago, but I feel like it's a good reminder in the modern AI era.

There's no doubt about it... We're entering a period of uncertainty and difficulty, but there will also be opportunity if we're willing to learn and evolve.

[Michael Sitler @msitler]

When you ask someone why they prefer Product A over Product B and they say "because it has more features and functionality."

[Michael Sitler @msitler]

Planning isn’t sexy in the current AI-hyped market. It takes human thought and can’t be a “fully automated agentic process.”

[spencer @techspence]

A major leadership failure in Cybersecurity is buying tools first then figuring out where they fit and how to use them. That’s super backwards. Plan first, implementation second.

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

Look, patching cadence is becoming an existential issue for most orgs.

AI-driven vuln discovery means n-days are landing faster, exploit code drops faster, and the window between "CVE published" and "mass scanning" is collapsing.

Your monthly patch cycle is dead. RIP.
🧵1

[spencer @techspence]

Just because something CAN be automated doesn’t mean it SHOULD.