Analyst @Hutzpah Consulting covering Identity & Data Security; formerly pre-revenue marketing, HW/SW in startup land
Articles by Jack Poller
Frontier AI Broke the Vulnerability Math
For 19 years, the Verizon Data Breach Investigations Report (DBIR) told a consistent story about how attackers get in: they use somebody’s password. Attackers broke that streak in 2026. Exploitation of vulnerabilities became the leading initial access vector, at 31% of breaches compared to credential abuse at 13%, and the 55% year-over-year surge behind that shift cost stolen credentials the top spot.
AI Wearables, EvilTokens Phishing and Airport LiDAR
HomeTechstrong GangAI Wearables, EvilTokens Phishing and Airport LiDAR Guests: Jack Poller, Jeff Reich, Jon Swartz, Tracy Ragan Category: Techstrong Gang Date: September 28, 2026 AI wearables promise to bring personal assistants closer to everyday life. In this Techstrong Gang discussion, Mike Vizard, Jack Poller, Tracy Ragan, Jon Swartz and Jeff Reich examine three connected stories about utility, identity and privacy.
Splunk’s IT Unification Bet Meets AI’s Energy Reality
HomeTechstrong GangSplunk’s IT Unification Bet Meets AI’s Energy Reality Guests: Camberley Bates, Jack Poller, Jeff Reich, Tracy Ragan Hosts: Mike Vizard Category: Techstrong Gang Date: September 18, 2026 Splunk IT unification is taking center stage as the agentic AI era forces enterprise vendors to rethink how they connect observability, security, and operations.
9/11 Lessons, AI Risk and Germany’s Cyberdome
HomeTechstrong Gang9/11 Lessons, AI Risk and Germany’s Cyberdome Guests: Jack Poller, Jeff Reich, Jon Swartz, Tracy Ragan Hosts: Mike Vizard Category: Techstrong Gang Date: September 11, 2026 Techstrong Gang brings together a respectful reflection and a forward-looking security discussion. AI risk governance frames the episode’s central question: How do teams prepare before pressure exposes a weakness? Mike Vizard hosts Jon Swartz, Jack Poller, Tracy Ragan and Jeff Reich.
GPT-6 Astra’s AGI Warning Meets a Mystery AI Outage
An AI safety risk is now front and center in the industry conversation. OpenAI’s newest model, Astra, just crossed a “critical” cybersecurity risk threshold. The company is already framing it as the start of the AGI era. On this episode of the show, host Mike Vizard is joined by Jack Poller, Tracy Ragan, and Jon Swartz. They break down what the Astra threshold actually means.
AI Security Risks, Drone Delivery Mishaps & the ChatTJB Hype Check
HomeTechstrong GangAI Security Risks, Drone Delivery Mishaps & the ChatTJB H... Guests: Jack Poller, Jeff Reich, Jiewen Wang, Jon Swartz, Tracy Ragan Hosts: Mike Vizard Category: Techstrong Gang Date: August 21, 2026 Drone delivery is hitting turbulence. Meanwhile, AI hype is colliding with reality. And AI security risk is shifting fast. On this episode of Techstrong TV’s live tech panel, host Mike Vizard is joined by Jack Poller, Tracy Ragan, Jon Swartz, Jeff Reich, and Jiewen Wang.
Cyber Privateers Policy Sparks Security Debate
New cyber privateers policy lets private firms hit foreign hackers. See what it means for security, data privacy, and water utilities.
Quis Custodiet Ipsos Custodes? What DoD’s CMMC Pause Gets Wrong About Trust
Two thousand years ago, the Roman poet Juvenal asked a question that every security professional eventually confronts: Quis custodiet ipsos custodes? Who watches the watchers? It’s a question about power, verification, and the uncomfortable truth that even the people we trust to enforce the rules need someone checking their work. This month, the Department of Defense effectively answered that question for a large swath of the Defense Industrial Base: nobody. Not for a while, anyway.
When “Air-Gapped” Stops Meaning Anything: What TrojPix Should Teach Every CISO
Researchers from Shandong University and Quan Cheng Laboratory just unveiled TrojPix, a technique that turns an ordinary HDMI cable into a covert radio transmitter. The user-mode malware — no admin rights required — subtly modulates on-screen pixels in ways invisible to the human eye. The video cable’s own switching currents radiate that data as an RF signal, which an attacker up to 208 meters away, through concrete walls, can intercept.
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)
In the first installment of this series, I walked through how I leveraged large language models to assist in identifying several vulnerabilities in the FreeBSD kernel, including a stack-based buffer overflow assigned CVE-2026-3038. This raised a natural follow-up question. Can language models effectively write exploits for memory corruption vulnerabilities? This article explores that question. I’ll detail two exploit chains I developed that achieve a full escape from a FreeBSD jail environment.
Credentials Lost the Top Spot. They Didn’t Lose Their Teeth
The 2026 Verizon Data Breach Investigations Report delivered a finding that many security leaders read as a turning point: for the first time in the report’s nineteen-year history, exploitation of vulnerabilities overtook credential abuse as the leading initial-access vector. Exploitation jumped to 31% of breaches—a 55% year-over-year surge—while credential abuse fell to 13%.
Senator Sanders Wants to Own AI Companies — and Hand America’s Adversaries the Keys
Senator Bernie Sanders published an op-ed in the New York Times last week demanding that the federal government seize a 50% equity stake in America’s largest AI companies. His proposed American AI Sovereign Wealth Fund Act would accomplish this through a one-time tax paid not in cash but in stock — handing Washington board seats, voting rights, and a direct role in steering some of the most consequential technology companies on earth. Sanders frames this as democratic accountability.
When Governments Mistake Envy for Policy
Senator Bernie Sanders published an op-ed in the New York Times last week demanding that the federal government seize a 50% equity stake in America’s largest AI companies. His proposed American AI Sovereign Wealth Fund Act would accomplish this through a one-time tax paid not in cash but in stock — handing Washington board seats, voting rights, and a direct role in steering some of the most consequential technology companies on earth. Sanders frames this as democratic accountability.
NIST’s Nine: The PQC Signature Race Moves to Round Three
Quantum-resistant cryptography requires solving two distinct problems simultaneously, and conflating them is a mistake that enterprise security programs cannot afford to make. Key encapsulation mechanisms (KEMs) protect the confidentiality of data in transit — they are the quantum-safe replacement for the key exchange protocols that secure TLS connections, VPNs, and encrypted communications.
The Quantum Arms Race: Why Washington Just Wrote a $2 Billion Check to Nine Companies
Quantum computing has moved from the physics lab into the theater of geopolitical competition, and Washington has decided it cannot afford to watch from the sidelines. Governments that master quantum technology will control the ability to break existing cryptographic infrastructure, simulate molecular interactions at a scale that transforms drug discovery and materials science, and optimize logistics and financial systems with a precision that classical computing cannot approach.
Beyond Moore’s Law: The Hyper-Acceleration of Autonomous AI Cyber Capabilities
The UK’s AI Security Institute (AISI) has documented something that should reorder every CISO’s threat model and every board’s risk conversation: the length of complex cyber tasks that frontier AI models can autonomously complete is doubling every few months. That single data point deserves to land before anything else, because it represents a fundamental shift in the physics of technological risk.
The Exception Economy: When Security Teams Stop Protecting and Start Negotiating
There is a term that has quietly become the most accurate description of how enterprise security operates in 2026, and it did not come from a CISO, a standards body, or a think tank. It came from a vendor press release. But that does not make it wrong.
The Half of Agent Security You’re Not Governing
When security teams confront AI agent risk, they reach for familiar instruments: scan the MCP servers, audit the supply chain, flag known vulnerabilities. That work matters, but it addresses only the observable half of the attack surface. The other half lives not in the code agents execute, but in the reasoning they perform — producing no structured logs, triggering no alerts, and leaving almost no forensic trail.
Frameworks Don’t Build Trust. Adoption Does
The cybersecurity industry has never suffered a shortage of frameworks. What it has historically lacked is frameworks with enough institutional weight to function as genuine market signals — documents that procurement teams, auditors, and regulators treat as meaningful rather than decorative. The Cloud Security Alliance’s STAR program has been one of the rare exceptions, and understanding why matters enormously as CSA now extends that machinery into artificial intelligence.
When Geopolitics Writes Your Compliance Roadmap
Cyber policy has always lagged cyber reality. Regulations arrive after breaches, frameworks emerge after failures, and accountability structures materialize long after the damage lands on someone else’s balance sheet. NCC Group’s fifth edition of its Global Cyber Policy Radar suggests that cycle is finally breaking — not because governments have gotten smarter, but because the stakes have grown too large to ignore.
Anthropic Just Gave Defenders a Firehose. They’re Already Drowning.
Anthropic announced Project Glasswing last week with the kind of language reserved for genuine inflection points. Claude Mythos Preview, a frontier model the company deliberately chose not to release publicly, had already identified thousands of zero-day vulnerabilities across every major operating system and web browser — including a bug that had been sitting undetected in OpenBSD for 27 years.
The Web Is Full of Traps — and AI Agents Walk Right into Them
The enterprise is deploying AI agents at a pace that has outrun every security framework written to govern them. These agents don’t just answer questions — they browse websites, retrieve documents, call APIs, execute code, manage email, initiate financial transactions, and spawn sub-agents to tackle complex workflows. They operate autonomously, at machine speed, often with minimal human oversight. The attack surface this creates is larger and categorically different than what came before.
Standardize or Suffer: The JCHK Blueprint for MSSPs Defending SMB and SME Clients
Advanced persistent threats don’t discriminate by organization size — they discriminate by defense capability. Nation-state actors and their proxies invest months conducting reconnaissance, moving laterally through networks with surgical patience, and exfiltrating data long before any alert fires.
Your Next Employee Might Not Exist: LexisNexis Report Exposes the Synthetic Identity Explosion
The cybercrime landscape has always rewarded speed — smash-and-grab credential theft, rapid account takeovers, opportunistic phishing. But the LexisNexis Risk Solutions 2026 Cybercrime Report, derived from analysis of more than 116 billion online transactions, signals a fundamental strategic shift. Fraud is no longer just fast. Increasingly, it is deliberate, methodical, and terrifyingly patient.
83% of Cloud Breaches Start with Identity. AI Agents are About to Make it Worse.
Google’s H1 2026 Cloud Threat Horizons Report, produced by the combined intelligence of Google Threat Intelligence Group, Mandiant Incident Response, and the Office of the CISO, documents something security leaders have been bracing for: The threat landscape isn’t just evolving, it’s accelerating past our ability to respond with the tools and organizational instincts we’ve built over the last two decades.
The White House Got the Cyber Strategy Right — By Knowing What Not to Do
There is a reliable pattern to how Washington responds to cybersecurity crises. Breach a federal agency, compromise critical infrastructure, embarrass a major defense contractor, and the reflex is the same: Appoint a task force, mandate a framework, publish a compliance checklist, and call it security. For two decades, this approach has produced impressive documentation and modest results. The adversaries, meanwhile, kept winning.
Meta’s AI Safety Chief Couldn’t Stop Her Own Agent. What Makes You Think You Can Stop Yours?
Two incidents from the last two weeks of February need to be read together, because separately they look like cautionary anecdotes and together they look like a threat doctrine. Incident One: An autonomous bot called hackerbot-claw attacked seven major open-source repositories—Microsoft, DataDog, the CNCF, and Trivy among them.
Meta’s AI Safety Chief Couldn’t Stop Her Own Agent. What Makes You Think You Can Stop Yours?
Two incidents from the last two weeks of February need to be read together, because separately they look like cautionary anecdotes and together they look like a threat doctrine. Incident One: An autonomous bot called hackerbot-claw attacked seven major open-source repositories—Microsoft, DataDog, the CNCF, and Trivy among them.
Anthropic Didn’t Kill Cybersecurity. It Just Reminded Us There Are Two Doors.
On February 20, 2026, Anthropic announced Claude Code Security — a tool that scans software codebases for vulnerabilities and suggests patches — and Wall Street obliged with the kind of panic selling usually reserved for banking crises and geopolitical shocks. CrowdStrike fell 8%. Cloudflare lost 8.1%. Okta dropped 9.2%. SailPoint shed 9.4%. JFrog plunged nearly 25%.
The Chicken Littles of Silicon Valley: Why AI Doomsayers Are Repeating History’s Greatest Mistake
The sky has never been falling. Yet here we are again, watching a new generation of prognosticators prophecy civilizational collapse while evidence of human adaptability and economic dynamism surrounds them. Salon’s recent piece about “swarms of AI bots threatening democracy” epitomizes this tiresome pattern—a sensational claim dressed up in legitimate-sounding language that dissolves upon even cursory examination.
The Lock, Not the Alarm: How Palo Alto’s Koi Acquisition Rewrites Endpoint Security
The acquisition of Koi Security isn’t just a product play — it’s a declaration that the agentic era has created an entirely new threat surface, and the vendor who governs it first will own the next decade of enterprise security. One week after closing a $25 billion acquisition of CyberArk — one of the largest deals in cybersecurity history — Palo Alto Networks announced its intent to acquire Koi Security, a one-year-old Israeli startup, for approximately $400 million.
The FBI Recovered “Deleted” Nest Cam Footage - Here’s Why Every CISO Should Panic
A Google Nest doorbell camera captured a masked, armed individual approaching Nancy Guthrie’s Tucson home at 1:47 a.m. on the night she disappeared. The suspect then disabled the camera. Guthrie had no active Nest subscription — meaning Google’s own documentation says that footage should have been automatically purged within three to six hours. Ten days later, the FBI recovered it anyway.
Beyond the Chatbot: Why NIST is Rewriting the Rules for Autonomous AI
The chatbot era has ended. For two years, we’ve interacted with digital assistants that summarize emails and suggest recipes, but the National Institute of Standards and Technology (NIST) now draws a definitive line between machines that talk and machines that act. Their newly released Request for Information (RFI) signals a fundamental paradigm shift in how we must approach AI risk.
All Aboard the Zero-Trust Train
The castle has fallen. The moat has dried up. Your perimeter? It’s a fiction you’ve been telling yourself while adversaries waltz through your “trusted” internal network like they own the place. If you’re still clinging to perimeter-based security, you need to wake up! The National Security Agency just published its first in a series of Zero Trust Implementation Guidelines (ZIGs), and they’re blowing the whistle because this train is leaving the station. Your organization cannot afford to miss it.
We’re Moving Too Fast: Why AI’s Race to Market Is a Security Disaster
The recently disclosed ServiceNow vulnerability should terrify every CISO in America. CVE-2025-12420, dubbed “BodySnatcher,” represents everything wrong with how we’re deploying AI in the enterprise today. An unauthenticated attacker—someone who has never logged into your system, sitting anywhere in the world—can impersonate your administrators using nothing more than an email address.
Can a Transparent Piece of Plastic Win the Invisible War on Your Identity?
Identity systems hold modern life together, yet we barely notice them until they fail. Every time someone starts a new job, crosses a border, or walks into a secure building, an official must answer one deceptively simple question: Is this person really who they claim to be? That single moment—matching a living, breathing human to a piece of paper backed by a government—anchors every employment verification, every airport security lane, every passport control booth.
Gartner’s AI Browser Ban: Rearranging Deck Chairs on the Titanic
The cybersecurity world loves a simple solution to a complex problem, and Gartner delivered exactly that with its recent advisory: “Block all AI browsers for the foreseeable future.” The esteemed analyst firm warns that agentic browsers—tools like Perplexity’s Comet and OpenAI’s ChatGPT Atlas—pose too much risk for corporate use.
Microsoft Takes Aim at “Swivel-Chair Security” with Defender Portal Overhaul
At a recent Tech Field Day Exclusive event, Microsoft unveiled a significant evolution of its security operations strategy—one that attempts to solve a problem plaguing security teams everywhere: the exhausting practice of jumping between multiple consoles just to understand a single attack.
Microsoft Takes Aim at “Swivel-Chair Security” with Defender Portal Overhaul
At a recent Tech Field Day Exclusive event, Microsoft unveiled a significant evolution of its security operations strategy—one that attempts to solve a problem plaguing security teams everywhere: the exhausting practice of jumping between multiple consoles just to understand a single attack.
Building AI Resilience: Turning Your Greatest Risk into Sustainable Advantage
LinkedIn respects your privacy LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including professional and job ads) on and off LinkedIn. Learn more in our Cookie Policy. Select Accept to consent or Reject to decline non-essential cookies for this use. You can update your choices at any time in your settings.
The Death of Legacy MFA and What Must Rise in Its Place
Tycoon 2FA proves that the old promises of “strong MFA” came with fine print all along: when an attacker sits invisibly in the middle, your codes, pushes, and one-time passwords become their codes, pushes, and one-time passwords too. Tycoon 2FA delivers a phishing-as-a-service kit that hands even modestly skilled attackers a turnkey adversary-in-the-middle platform.
Commvault Cloud Unity Ushers In a New Era of AI Resilience
The enterprise world stands at the threshold of a revolutionary inflection point: AI is reshaping how organizations operate, how data flows, and how critical decisions unfold. AI adoption is accelerating faster than any previous technology in history. Big tech alone is investing over $400 billion in AI infrastructure this year, fueling trillions in expected economic value. AI is no longer a research experiment; it forms the core of modern business.
The Dawn of Digital Fortitude: Commvault Cloud Unity Defines AI Resilience
The enterprise world stands at the threshold of a revolutionary inflection point: AI is reshaping how organizations operate, how data flows, and how critical decisions unfold. AI adoption is accelerating faster than any previous technology in history. Big tech alone is investing over $400 billion in AI infrastructure this year, fueling trillions in expected economic value. AI is no longer a research experiment; it forms the core of modern business.
The Dawn of Digital Fortitude: Commvault Cloud Unity Defines AI Resilience
Sanjay Mirchandani Announcing Commvault Cloud Unity and Resilience Operations at Commvault Shift The enterprise world stands at the threshold of a revolutionary inflection point: AI is reshaping how organizations operate, how data flows, and how critical decisions unfold. AI adoption is accelerating faster than any previous technology in history. Big tech alone is investing over $400 billion in AI infrastructure this year, fueling trillions in expected economic value.
How Fortinet Secures AI Agents in Cloud Environments
At a recent Cloud Field Day event, Fortinet demonstrated something that should concern every cloud architect: generative AI applications are creating security vulnerabilities that traditional defenses weren’t built to handle. The presentation revealed how AI agents introduce complex traffic flows that attackers are already learning to exploit. Cloud platforms offer the GPU and TPU scalability that enterprises need to rapidly deploy AI services.
When Machines Attack Machines: The New Reality of AI Security
Unlike conventional IT systems—with bounded entry points, predictable patch cycles, and known vulnerabilities—large language models (LLMs) and next-generation AI agents create an attack surface so broad, dynamic, and interconnected that comprehensively mapping or policing it becomes nearly impossible. Every new integration, plugin, RAG pipeline, or deployment scenario multiplies exposure: AI systems undergo constant updates and retraining, creating novel, unknown behaviors.
When Machines Attack Machines: The New Reality of AI Security
Unlike conventional IT systems—with bounded entry points, predictable patch cycles, and known vulnerabilities—large language models (LLMs) and next-generation AI agents create an attack surface so broad, dynamic, and interconnected that comprehensively mapping or policing it becomes nearly impossible. Every new integration, plugin, RAG pipeline, or deployment scenario multiplies exposure: AI systems undergo constant updates and retraining, creating novel, unknown behaviors.
HPE’s Post-Juniper Vision: AI-Driven Security at Enterprise Scale
At Security Field Day, Hewlett Packard Enterprise showcased the results of its most ambitious integration effort: combining decades of networking expertise under a single, AI-driven security vision. The centerpiece is the completion of the Juniper Networks acquisition in early July, creating the newly formed HPE Networking organization. This follows HPE’s acquisition of Silver Peak five years ago, along with numerous other strategic additions.
HPE’s Post-Juniper Vision: AI-Driven Security at Enterprise Scale
At Security Field Day, Hewlett Packard Enterprise showcased the results of its most ambitious integration effort: combining decades of networking expertise under a single, AI-driven security vision. The centerpiece is the completion of the Juniper Networks acquisition in early July, creating the newly formed HPE Networking organization. This follows HPE’s acquisition of Silver Peak five years ago, along with numerous other strategic additions.
Nile’s Bold Claim: Your LAN Architecture Is Fundamentally Broken
At Security Field Day, Nile delivered a message that challenges decades of enterprise networking orthodoxy: the traditional Local Area Network architecture is fundamentally obsolete for modern security requirements. The problem isn’t subtle. While connectivity remains the lifeblood of most organizations, traditional LAN environments—where the majority of users and devices operate—receive the least investment and are consequently the least secure within the enterprise attack surface.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jack
Contact Jack, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack