Log inSign up
Image
user avatar
Spektion
@spektion
Continuous Runtime Exposure Management. Find what's exploitable, not just what's installed. CVEs, non-CVE weaknesses, and AI workloads in one runtime agent.
Dripping Springs, TX, USA
spektion.com
Joined December 2021
6
Following
14
Followers
RepliesMedia
  • user avatar
    Spektion
    @spektion
    Aug 7
    Most AI agents did not arrive through procurement. They arrived through a developer who wanted to move faster. No ticket. No vendor review. No inventory entry. An AI program built from approved platforms describes a smaller population than the one running.
  • user avatar
    Spektion
    @spektion
    Aug 5
    Give a security program a percentage to move, and the percentage moves. Not because anyone is lying. Because every enrichment doubles as a reason to defer, and deferral is what makes the number go down. Lower CVE density is not lower risk.
    Image
    00:00
  • user avatar
    Spektion
    @spektion
    Aug 4
    The catalog says the CVE is present. The directive says determine whether you were compromised. The only way to determine it is to analyze the box. So you analyze 30 boxes and find the software was decommissioned last year. Present is not the same as running.
    Image
  • user avatar
    Spektion
    @spektion
    Aug 3
    A J.P. Morgan investor letter, co-signed by the bank's Global CISO: in 61% of reported incidents the patch was already available. More than 80% of security teams have deferred a patch to avoid business disruption. That is a judgment call made without evidence.
  • user avatar
    Spektion
    @spektion
    Jul 29
    "Internet reachable" is a fact about the asset. Not about the CVE's trigger. No tool in this market hands you a full path, sink and proof object today. We do not either. The real choice is not perfect proof. It is score versus evidence. linkedin.com/feed/update/ur…
    Image