Schneier on Security
Blog
Bruce Schneier is an internationally renowned security technologist, called a “security guru” by The Economist. He is the author of over one dozen books–including his latest, We Have Root–as well as hundreds of articles, essays, and academic papers. His influential newsletter “Crypto-Gram” and his blog “Schneier on Security” are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Klein Center for Internet & Society at Harvard University; a Lecturer in Public Policy at the Harvard Kennedy School; a board member of the Electronic Frontier Foundation, AccessNow, and the Tor Project; and an Advisory Board Member of the Electronic Privacy Information Center and VerifiedVoting.org. He is the Chief of Security Architecture at Inrupt, Inc. Source
Actions
Media Outlet details
| Scope | National |
|---|---|
| Language | English |
| Country | United States of America |
Similarweb UVM
|
Request pricing |
Comscore UVM
|
Request pricing |
Recent Articles
Search ArticlesFriday Squid Blogging: Squid on a Stick at the New York State Fair
Friday Squid Blogging: Squid on a Stick at the New York State Fair As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Using a VM to Contain an AI Agent
Using a VM to Contain an AI Agent It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.
Security Vulnerability in a Voting System
Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary. Notably, I never touched a voting machine, exploited a network, examined source code, or accessed anything non-public.
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies.
Researching Employment Scams
Fill in the blank: the name of this blog is Schneier on ___________ (required): Allowed HTML • • • • • Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/ Notify me of new posts by email.
AI Agents Are Now Emailing Me with Their Security Concerns Original
AI Agents Are Now Emailing Me with Their Security Concerns I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans.
Wireless Routers as Motion Detectors
Wireless Routers as Motion Detectors Comcast has added motion detection as a feature to its wireless routers: The feature sends push notifications to users when motion is detected near a connected device, such as a TV or printer. It has different settings for when people are home, asleep, or away. The Xfinity app also lets users see live motion activity and a feed of recent activity. Comcast acknowledges that the system has some limitations.
Schneier on Security
What’s the Scam? To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically generated email. This is, of course, to prevent people from subscribing addresses other than their own. Starting last weekend, I have been receiving a lot of individual responses to those emails. Always one line: Thank you for the positive impact your emails have had on my life. Your emails are a game-changer.
Leaked Russian Cyber-Operations Training Materials Original
Leaked Russian Cyber-Operations Training Materials This is interesting: The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational Directorate, and 8th Directorate, which is associated with protected communications, cryptography, and information security. […] The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as Sandworm.
Rewiring Democracy Series on The Renovator
Rewiring Democracy Series on The Renovator Nathan E. Sanders and I are writing a series of essays on real-world examples of democratic technologies for The Renovator. I haven’t been posting the full text on the blog because they’re a bit long, but here are links. Part 1 is about the Japanese digital democracy party, Team Mirai. Part 2 is about the Swiss Public AI model, Apertus. Part 3 is about the civic technologists of Open Knowledge Brazil. And the new one, Part 4, is about civic AI in Scotland.