Jared Ablon

26.1% of Agent Skills contain security vulnerabilities. That's from a study of 31,000+ skills in the wild. But here's what is concerning: existing supply chain security frameworks don't fully cover these threats. Agent Skills are markdown files with instructions, packaged with scripts and resources for AI coding assistants. They look like documentation. But when an agent reads them, those instructions execute with full permissions, accessing files, running scripts, installing packages. Agent skills are the new "dependencies" in the era of AI Coding agents and we need a new threat model for it. Here is our attempt at describing the threat model for Agent Skills. Full blog: https://lnkd.in/gr7C23PB

13

3 Comments

"Hudson Rock suggests that attackers breached ShareFile, Nextcloud, and ownCloud environments used by organizations across multiple sectors, including aviation, defense, healthcare, utilities, mass transit, telecommunications, legal, real estate, and government." via BleepingComputer https://lnkd.in/dkTnGv-N

25

1 Comment

One of the most common comments I hear from security leaders: “We can’t justify spending on another platform.” Fair. Budgets are tight. Every dollar is scrutinized. Security rarely gets excess funding. But here’s the tension. The same teams that hesitate to invest in better visibility are often operating without clear insight into: Analytics based procurement decisions Duplicate vendor spend Inconsistent purchasing Low-impact risks consuming high-impact dollars Remediation that never gets verified In other words, they’re trying to protect the budget… Without full visibility into how the budget is performing. That’s not a criticism. It’s structural. When risk data is fragmented across spreadsheets, PDFs, and local processes, you can’t see patterns. And if you can’t see patterns, you can’t optimize spend. So money leaks quietly. Not because the team is careless. Because the system doesn’t surface inefficiencies. What’s interesting is this: The cost of consolidation feels visible and immediate. The cost of fragmentation feels invisible and ongoing. Most leaders only see one of those line items. The best security programs I’ve seen don’t just reduce risk. They make every dollar traceable to a prioritized outcome. If you’re overseeing a multi-site environment, it’s worth asking: Do you truly know where your security dollars are working hardest? Or are you defending a budget you can’t fully see?

6

2 Comments

Privacy isn’t automatic — you have to turn it on. These six Safari settings block fingerprinting, stop hidden tracking scripts, and wipe stored data that follows you across apps. Two minutes of setup can dramatically reduce how much of your life gets collected.

8

A gentle request to investors: fund startups building real security capability, privacy-first design, and continuous runtime assurance NOT another generic ‘AI security copilot’ chasing TAM please. The industry needs tools that actually stop breaches.

10

2 Comments

Your security contractor says compliance is at 98%. Your actual audit results tell a different story. I've observed this pattern repeatedly: organizations rely on vendor self-reporting for security performance metrics, only to discover significant gaps during independent assessments. The challenge isn't dishonesty - it's perspective. Contractors naturally view their performance through the lens of effort and intent. But compliance requires measurable outcomes aligned with your specific risk tolerance and contractual obligations. Independent oversight creates accountability without vendor conflict. It validates that your security investments deliver the protection you're paying for, not just the protection they think you need. When performance visibility becomes vendor-neutral, compliance becomes measurable. GreyShield Group provides intelligence-driven oversight that ensures contractual alignment. Contact us at intelligence@greyshieldgroup.com #VendorOversight #ThirdPartyRisk #SecurityOperations #ContractCompliance

3