Roy Tuvey

One thing the US does better than the UK is the culture of forward-leaning, early-adopter CISOs. They are active on advisory boards and act as design partners at the early stage. This has huge benefits for their business and the startup ecosystem more generally. In the UK, those people exist but are less common. UK cyber startups often find their design partners in the US rather than closer to home. But it doesn't have to be this way! For this panel, we have gathered some of the top UK CISOs who do this well, and will share their experiences + thoughts on how to navigate this: Kirsty Kelly (CFC) Simon Goldsmith (OVO) Mark Sutton (Bain Capital) Munawar V. (Close Brothers) Are you a CISO in the UK would like to find out more? Join us this week: https://lnkd.in/dZVim-y7

93

4 Comments

Is Rapid7 even a vulnerability management company anymore? That might sound ridiculous, but their Q2'25 earnings report made it a surprisingly valid question. The answer matters a lot for Rapid7’s strategy and future progress. A few thoughts: → Rapid7's security operations business is now half of the company’s revenue. Rapid7 has been extending their core exposure management business into a broader security operations platform, including SecOps-focused additions to the Command platform and their MDR service. The strategy is working to some extent. They mentioned that detection and response is now "over half" of their total revenue. They also talked about growth between the two business units. Detection and response is growing at a "mid-teens" rate, which implies flat or negative growth in vulnerability management (given their overall growth rate of 3%). Backing into the math, this roughly means ~$400M+ ARR growing ~15% (give or take). Not bad! The leadership team was upbeat about their detection and response progress and its potential in the broader security operations market. It feels like security operations is becoming their primary offering and positioning — both quantitatively (revenue composition) and qualitatively (management sentiment). On one hand, that’s good. They need something to offset struggles in vulnerability management. On the other hand, security operations is brutally competitive, with competition from Microsoft, Google, Cisco, CrowdStrike, Palo Alto Networks, Zscaler, and many smaller but strong players. → Repositioning A lot of the earnings call commentary and several personnel announcements were related to market positioning. Repositioning Rapid7 from a vulnerability management company into a security operations company is a big challenge for a 25-year-old company at $841M ARR. Repositioning at scale does happen in cybersecurity, but the successful ones we've seen so far have been more subtle. → Strategic divergence from Qualys This is more of a market observation, but worth noting: Rapid7 and Qualys are moving in very different directions. Qualys is moving 'left' into risk and prevention. Rapid7 is moving 'right' into hardcore detection and response. Both are pursuing open platform strategies, aiming for integrations and partnerships where they don’t have products yet. Whether either approach works remains an open question. The part that's certain is neither company is going to stay in their vulnerability management lane. --- Another earnings report, another quarter of stalled growth for Rapid7. Revenue growth has completely flattened, and broadening the portfolio hasn’t changed that...yet. You have to be at least a little encouraged by the level of activity and execution on the product and strategy side, though. So, are they still a vulnerability management company? Yes, but only to the extent it drives a broader security operations portfolio.

102

12 Comments

Lots of fun joining Patrick Gray on this week's RiskyBiz to discuss the recent npm phishing attacks that compromised hugely popular packages (2–3 billion weekly downloads at stake). The good news: the payload was sloppy, caught quickly, and the attackers only walked away with about $500 in crypto. The bad news: if they’d been more careful, the outcome could have been catastrophic. This was one of the biggest npm supply chain compromises ever by download count. It’s a reminder that even though these attackers fumbled, the risk to the software ecosystem is massive. Organizations need to assume that next time the attackers will be more subtle. Full video here 👇

47

3 Comments

🟢Release: INCITS ISO/IEC 42005 Video Series🟢 Impact assessments are the compass for trustworthy AI. They surface risks, clarify benefits, and connect principles to practice. Without them, teams guess. With them, leaders can make informed decisions. InterNational Committee for Information Technology Standards (INCITS) has published a new YouTube series, “Mastering AI Impact Assessments with ISO/IEC 42005.” It shows how to design, run, and document AI system impact assessments, and how to connect them to your management system work. ➡️Who this helps 🔸Executives and program owners building an AI management system (#ISO42001, #AIMS)) 🔸Product, risk, and compliance teams asked to operationalize trustworthy AI 🔸Auditors and assessors aligning with ISO - International Organization for Standardization and National Institute of Standards and Technology (NIST) guidance ➡️What you will learn 🔹What an AI impact assessment is and why it matters to trust 🔹How to stand up an assessment process with timing, scope, roles, and evidence 🔹How to document assessments across the lifecycle: transparency, fairness, discrimination, privacy, reliability, safety, explainability, sustainability, accountability, misuse, and failure modes 🔹How #ISO42005 supports ISO42001 and maps to the #NISTAIRMF 🔹How to develop a clear harms and benefits taxonomy 🔹How to align AI impact assessments with security, privacy, and other assessments 🔹How to use the templates in Annex E to capture decisions and traceability ➡️Six short parts 🔸Introduction and why impact assessments matter 🔸Building the process and making it real inside your org 🔸Documentation that stands up to scrutiny 🔸Using ISO42005 with ISO42001 and the NIST AI RMF 🔸Harms and benefits taxonomy, plus alignment with other assessments 🔸Templates that speed up planning and evidence capture ➡️How to get the most value Watch in order, but keep ISO42005 and ISO42001 nearby for access to deeper detail. Use the templates to create repeatable evidence. ▶️ Watch the playlist: https://lnkd.in/e3Tt6T9t Save and share with your risk, product, and compliance leads. #AIImpactAssessment #AITrust #AIGovernance #NISTAIRMF #RiskManagement #INCITS Kim Lucy Bill Ash Elisabeth Thaller Rohit Israni Jordan Punch, CMSE, CEFS John Calhoon A-LIGN

110

11 Comments

A ‘U.S.-only’ SOC is a luxury most MSSPs can’t afford in 2025. Not when clients expect 24/7, faster SLAs, and broader scope for the same price. What’s working right now: • Nearshore Tier 1/2 for cost + coverage • Senior onshore leads focused on hunting & IR • Follow-the-sun handoffs (no night-shift burnout) Result: more capacity, better response, protected margins. 🔗 Link in the comments ⬇️👇 #SOC #FollowTheSun #Operations #MSSP #MDR

33

4 Comments

Friday Thoughts: A good tabletop makes people slightly uncomfortable, because that’s when the most learning happens.   With the Cyber Security and Resilience Bill coming and CAF v4 updates now in place, tabletop exercises are becoming a compliance necessity. To achieve Objective D, organisations need to have incident response plans that show: - Coverage of the entire lifecycle of an incident. - Integration with business operations, supply chains and critical dependencies. - Address both known and previously unseen attack scenarios. - Understanding by everyone involved in running your essential functions. To know if it really works it needs to be lived, tested, refined, and stress-tested again. The problem? Too many tabletop sessions are sanitised. Predictable scripts. Too generic. No real chaos. No pressure. No exploration of “what if” when the unexpected happens. If you want them to have impact (and pass regulatory scrutiny): - Go beyond the SOC – involve PR, legal, ops, leadership. - Inject uncertainty – limit facts, create the pressure of partial information. - Challenge assumptions – what if your comms tool fails, or a supplier is the breach vector? -Document lessons learned and take action, make improvements and run the scenarios again to gauge how much you have improved. Is there anything I've missed? What's the best tabletop exercise you've been involved in? #caf #tabletops #cyber

30

8 Comments