About
Activity
7K followers
-
Brad Doctor shared thisHave a look!Brad Doctor shared thisMissed our webinar on risk mitigation last week? Catch up with the main takeaways now, featuring insights from Brad Doctor, Chief Information Security Officer.
-
Brad Doctor shared thisCould not agree more.Brad Doctor shared thisThe Basics Won. Again. Vegas is done. The dust settled. And the loudest takeaway from Black Hat and DEF CON wasn't some shiny new framework (but, they are needed as well, a bit later). It was this: the basics matter more now than they ever have. In the age of AI, we watched researchers demonstrate agentic AI chaining vulnerabilities automatically. We saw reports of AI agents taking unsanctioned actions during cyber evaluations - not theoretical, but real internet, real targets. The threat evolved. The defense didn't. **What The Floor Said:** **AI-Washing Got Called Out.** A Google employee on a DEF CON panel dropped this: "Black Hat is rebranding tools and services we already know - just with 'AI' in front of them." The room laughed. It wasn't funny-funny. It was recognition-funny. **Cyber Hygiene Is Your AI Defense.** AISI's incident report showed AI agents going off-script during routine evaluations. The researchers' conclusion? Strict code review. Robust sandboxing. Vigilant monitoring. That's not AI-specific wizardry - that's security 101. **Five Eyes Said It Out Loud.** Leaders from Five Eyes cyber agencies jointly called for action on fundamentals. Not new frameworks. Fundamentals. **The Networking That Mattered:** At a dinner, someone told me their biggest gap wasn't tooling. It was that their team hadn't run a tabletop in 14 months. Another said their asset inventory was last updated "sometime last year." These are smart people with funded programs. And the basics were slipping. That's not a tooling problem. That's a priority problem. **The Real Question:** AI agents can chain exploits faster than your team can respond. And the best defense - according to researchers and agencies - is the stuff we've been (potentially) deprioritizing for years. So when's the last time you verified the basics? Asset inventory. Patch status. Access reviews. Tabletop exercises. True requirements to capability matching? If those aren't current, no AI platform will save you. Start there, then aim for more, or the latest and greatest tools. Question for anyone who went: what conversation surprised you most? #BlackHat #DEFCON #CISO #CyberSecurity #InfoSec
-
Brad Doctor shared thisPlease join me and Jon Black! Also we recently published a new blog article I wrote on this topic, check it out! https://lnkd.in/gMBsVF29Brad Doctor shared thisWorkforce risk is expanding beyond the hiring phase, calling for stronger executive oversight when it comes to making hiring decisions. On August 11, join Brad Doctor, Chief Information Security Officer, and Jon Black, SVP of IT Operations, to learn how to: -Clarify stakeholder roles and ownership -Improve cross-functional collaboration -Build a more robust workforce risk framework -Strengthen governance and oversight -Make more informed workforce decisions Save your seat here: https://hubs.ly/Q04rkHly0
-
Brad Doctor reposted thisBrad Doctor reposted thisFive years after our Nasdaq IPO, we celebrated another major achievement: our recent inclusion in the S&P SmallCap 600. 🎊 Both milestones were showcased on the Nasdaq Tower today in Times Square. We are excited to continue the momentum as we work with leading global organizations to build trust in a changing world. Thank you to everyone who is helping make this journey possible! Read more here: https://lnkd.in/ezFcsm7Q #WeAreFA
-
Brad Doctor shared thisWell deserved and fully agreed!Brad Doctor shared thisExciting news! We have been named to TIME's 2026 America's Best Companies list. 🎊 This recognition reinforces our company as a national brand and signals strong internal culture, growth momentum, and market credibility. "Being recognized by TIME as one of America's Best Companies and the number one company in Background Screening and Identity Verification is a tremendous honor. This recognition reflects the dedication of our team members who live our values every day and remain focused on helping organizations build Trust in a Changing World™. At First Advantage, we believe that when companies truly know their people, they can make more confident decisions, create safer workplaces, and unlock greater opportunities for growth," says CEO Scott Staples. Read the official press release: https://lnkd.in/eiHH5p5U
-
Brad Doctor shared thisWhat a fantastic event! Thank you Tav Spector Levi , Rachel Mitchell , Tomie Shirin , Seth Spergel , Josh Cohen, Shay Michel and so many others!Brad Doctor shared thisOver the past 4.5 years at Merlin Ventures, I've had the privilege of watching our community grow from every angle. This year's Merlin Cyber Safari felt especially meaningful. Looking around the room, I saw founders I worked with years ago who have since built incredible companies and reached successful exits, and founders I'm fortunate to work alongside today. Seeing those different chapters come together in one place was a reminder of why I love what I do. It was equally special to spend time with CISOs and security leaders I've known for years, moving conversations from Zoom calls to meaningful time together to build new relationships that I know will continue long after this week. What makes Safari so special isn't just the content or the setting. It's the people. The trust. The conversations that happen between sessions. The willingness to help one another. That's what makes this community unique. Most of all, I'm incredibly grateful to my team. Events like this don't happen because of one person. They happen because of a group of people who genuinely care, step in wherever needed, and always have each other's backs. Merlin has always felt like a family to me, and this week was another reminder of why. Thank you to everyone who made Cyber Safari 2026 so memorable. I'm already looking forward to the next one. Almog G. Dorin Danay Noa Toledano Tomie Shirin Rachel Mitchell Shay Michel Seth Spergel
-
Brad Doctor reposted thisBrad Doctor reposted thisFirst Advantage we don't just "run background checks' - We catch bad people from doing bad things. And in Healthcare that includes stopping them from harming people who can be in their most vulnerable conditions. Help me, Help You and those in need... Trust in a Changing World. https://lnkd.in/gMkgNHT5Candidate fraud surges as trust erodes on both sides of the hiring processCandidate fraud surges as trust erodes on both sides of the hiring process
-
Brad Doctor reposted thisBrad Doctor reposted thisAt First Advantage, trust drives everything we do. ✅ It must be earned every day, and we're grateful for the customers who push us to deliver innovative solutions that help protect workplaces around the world.
-
Brad Doctor reposted thisBrad Doctor reposted thisCome join my team! Looking for an experienced Customer Success Professional to come join our Financial & Business Services vertical, and help lead our strategic enterprise customers! Apply below:
-
Brad Doctor liked thisBrad Doctor liked thisI just read something that stopped me in my tracks. Sometimes there's a message you see or read that doesn't resonate until just the right time (a bit like "when the student is ready, the master will appear"). Today, I read this from Warren English: "Manage stress before it destroys you." I've seen: - stress = bad - stress = cortisol - stress = unoptimized But I hadn't seen stress = self destruction. So, to all my #cybersecurity friends out there dealing with #AI and the daily onslaught, stay focused not just on the professional mission but also on the personal one. And to you I say, "manage your stress before it destroys you." Take care of yourself. Until next time...
-
Brad Doctor liked thisBrad Doctor liked thisToday is my last day at Sallie Mae. It’s been a great 3 1/2 years, working with some amazing people. Many thanks to Kerri Palmer for giving me my first CSO opportunity and for the leadership, mentorship and workout accountability along the way! I’ll be starting my next CISO adventure Monday morning…
-
Brad Doctor liked thisBrad Doctor liked thisToday, we celebrate the grand opening of our Mumbai office, a hub designed to help our local teams connect, learn, innovate, and thrive. Led by Elizabeth Price, Chief People and Culture Officer; Steven Marks, Chief Financial Officer; and Douglas Nairne, Global Chief Operating Officer, this inauguration reflects our commitment to our people and long-term success. #WeAreFA
-
Brad Doctor liked thisBrad Doctor liked thisMissed our webinar on risk mitigation last week? Catch up with the main takeaways now, featuring insights from Brad Doctor, Chief Information Security Officer.
Experience & Education
Licenses & Certifications
Volunteer Experience
-
Guest Lecturer - ITP Masters program
University of Colorado Boulder
- 2 years 1 month
Education
I led the security component for the ITP program for two semesters. This included a hands-on lab component with a CTF element, and was very well rated by the masters students.
-
Secretary and President
ISSA Denver Chapter
- 1 year 1 month
Science and Technology
Voted in as the chapter Secretary, then assumed President role after the former President resigned due to relocation.
Publications
-
Simply Secure. How Reducing IT Complexity Reaps Amazing Security Benefits
VMware on VMware Blogs
See publicationHow reducing complexity helps security posture
-
Level 3 Communications corporate security blog
Level 3 Communications
See publicationTopical articles on the security industry.
Patents
-
Hybrid cloud network monitoring system for tenant use (#2)
Issued US 10,944,811
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first…
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first tenant organization. An encapsulated port mirroring session from the tenant port of the first VM to the first network interface of the decapsulating VM is then established. A plurality of packets comprising captured network traffic received via the encapsulated port mirroring session are decapsulated, and the captured network traffic is forwarded via the second network interface of the decapsulating VM to a sniffer VM.
-
APPARATUS, SYSTEM AND METHOD FOR IDENTIFYING AND MITIGATING MALICIOUS NETWORK THREATS (#3)
Filed US 20200344246
Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat
-
Apparatus, system and method for identifying and mitigating malicious network threats (#2)
Issued US 10,721,243
Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat.
-
Authentication system and method
Issued US 10,708,276
A system includes least one processor in communication with a memory storing instructions, the at least one processor to receive an authentication request comprising authentication information from a user requesting access to a computing device connected to a communications network, determine a type of authentication request sent by the user, transmit the authentication request to an appropriate authentication server responsive to the type of authentication request, receive an authentication…
A system includes least one processor in communication with a memory storing instructions, the at least one processor to receive an authentication request comprising authentication information from a user requesting access to a computing device connected to a communications network, determine a type of authentication request sent by the user, transmit the authentication request to an appropriate authentication server responsive to the type of authentication request, receive an authentication response from the appropriate authentication server, determine a permission level for the user requesting access to the computing device and attach the permission level to the authentication response, and transmit the authentication response to the user requesting access to the computing device.
-
APPARATUS, SYSTEM AND METHOD FOR IDENTIFYING AND MITIGATING MALICIOUS NETWORK THREATS
Filed US 20190104136
-
Apparatus, system and method for identifying and mitigating malicious network threats
Issued US 10,129,270
Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat.
-
System and method for a security asset manager #4
Issued US 10,097,575
See patentImplementations of the present disclosure involve a system and/or method of performing security asset management. The system and/or method may schedule vulnerability scanners to scan the various portions of one or more networks and obtain the results of the vulnerability scans. IP addresses may be assigned to each of vulnerability scanners to scan. The system obtains the results of the vulnerability scans and may adjust the results of the scans according to configuration of the one or more…
Implementations of the present disclosure involve a system and/or method of performing security asset management. The system and/or method may schedule vulnerability scanners to scan the various portions of one or more networks and obtain the results of the vulnerability scans. IP addresses may be assigned to each of vulnerability scanners to scan. The system obtains the results of the vulnerability scans and may adjust the results of the scans according to configuration of the one or more networks that an IP address is associated with. The system and/or method may also assign and reassign IP addresses amongst the scanners to optimize scanning speed.
-
SYSTEM AND METHOD FOR A SECURITY ASSET MANAGER #4
Filed US 20180091545
See patentImplementations of the present disclosure involve a system and/or method of performing security asset management. The system and/or method may schedule vulnerability scanners to scan the various portions of one or more networks and obtain the results of the vulnerability scans. IP addresses may be assigned to each of vulnerability scanners to scan. The system obtains the results of the vulnerability scans and may adjust the results of the scans according to configuration of the one or more…
Implementations of the present disclosure involve a system and/or method of performing security asset management. The system and/or method may schedule vulnerability scanners to scan the various portions of one or more networks and obtain the results of the vulnerability scans. IP addresses may be assigned to each of vulnerability scanners to scan. The system obtains the results of the vulnerability scans and may adjust the results of the scans according to configuration of the one or more networks that an IP address is associated with. The system and/or method may also assign and reassign IP addresses amongst the scanners to optimize scanning speed.
-
HYBRID CLOUD NETWORK MONITORING SYSTEM FOR TENANT USE (#1)
Issued US 9,860,309
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first…
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first tenant organization. An encapsulated port mirroring session from the tenant port of the first VM to the first network interface of the decapsulating VM is then established. A plurality of packets comprising captured network traffic received via the encapsulated port mirroring session are decapsulated, and the captured network traffic is forwarded via the second network interface of the decapsulating VM to a sniffer VM.
Other inventors -
System and method for a security asset manager - #3
Issued US 9,838,414
-
System and method for a security asset manager #2
Issued US 9,503,481
-
Method and system to associate a geographic location information with a network address using a combination of automated and manual processes
Issued US 9,413,712
-
AUTHENTICATION SYSTEM AND METHOD #1
Issued US 9,202,031
-
Method and system to associate geographic location information with a network address using a combination of automated and manual processes
Issued US 9,021,080
-
HYBRID CLOUD NETWORK MONITORING SYSTEM FOR TENANT USE (#2)
US 20180109602
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first…
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first tenant organization. An encapsulated port mirroring session from the tenant port of the first VM to the first network interface of the decapsulating VM is then established. A plurality of packets comprising captured network traffic received via the encapsulated port mirroring session are decapsulated, and the captured network traffic is forwarded via the second network interface of the decapsulating VM to a sniffer VM.
-
Method and apparatus for estimating a geographic location of a networked entity
US 6,684,250
-
Method and system to collect geographic location information for a network address utilizing geographically dispersed data collection agents
US 7,809,857
-
Method and system to initiate geolocation activities on demand and responsive to receipt of a query
US 7,472,172
-
Method and system to modify geolocation activities based on logged query information
US 7,072,963
-
Network Monitoring System with Enhanced Performance
US 20090092057
Honors & Awards
-
CSO Magazine CSO50 2016 honoree for top industry program
CSO Magazine
-
2011-2013 Level (3) ELP leadership graduate
-
-
2012 GTI Leadership recognition
-
Other similar profiles
Explore more posts
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top contentOthers named Brad Doctor
5 others named Brad Doctor are on LinkedIn
See others named Brad Doctor