Lenny Zeltser

You can now receive my blog posts via email. Go ahead and sign up: https://zeltser.com/newsletter I've been writing more frequently than I have in recent years, and I'd rather share my articles directly than rely on an algorithm to decide whether to surface them.

My one-page cheat sheet offers practical writing tips for getting your message across clearly and concisely: https://zeltser.com/writing-tips-for-tech-professionals

Writing tips for tech professionals is among the most popular cheat sheets on my site. I just updated it to include AI-related advice: https://zeltser.com/writing-tips-for-tech-professionals

AI lets malware analysts go deeper and faster than ever before. The agent makes us fast, and our judgment makes us right. https://zeltser.com/ai-assisted-malware-analysis-tips

When everyone's attention is on a celebrity vulnerability, you can organize your investigation and share findings using this template. It's AI-friendly, of course. https://zeltser.com/high-profile-vulnerabilities

My new cheat sheet is out! This one helps malware analysts incorporate AI agents into their workflows, including how to spot an agent reporting a timed-out tool as having found nothing. https://zeltser.com/ai-assisted-malware-analysis-tips

Here's a short template for capturing and communicating details about a high-profile vulnerability. It helps you share your findings with internal stakeholders and is a starting point for external comms. https://zeltser.com/high-profile-vulnerabilities

AI-generated code was the AI asset our survey respondents most often reported having. Yet almost no one named it as a worry. This is just one of the findings that caught my attention. https://zeltser.com/ai-security-decisions-report

Sounil Yu and I surveyed 300+ security professionals about how their organizations secure AI. We published what we learned as a report, and here are the findings that surprised me most. https://zeltser.com/ai-security-decisions-report

I'm starting to look for my next role as a CISO, a security product leader, or an uncommon mix of the two. I was VP of Product at two security companies before becoming the founding CISO at one of them. If you know of a fit, I'd like to hear about it. https://zeltser.com/about

What may your AI agents do on their own? Many security teams reconstruct the answer from tool settings, runbooks, and whoever configured them. Recording those decisions in one table, one row per workflow, turns them into policy you can enforce. https://zeltser.com/security-autonomy-matrix

The AI security capability on your shortlist may already be in your stack, perhaps as a feature of a platform you license or a control another team operates. https://zeltser.com/ai-security-buying-questions

AI security products that sound alike can solve very different problems. I organized the questions I use to tell them apart, sorted by product type. https://zeltser.com/ai-security-market-field-guide

AI agents can earn autonomy the way medical residents earn unsupervised procedures, by performing under supervision first. The Security Autonomy Matrix lets you record each grant, how its autonomy can grow, and the trigger that takes it back. https://zeltser.com/security-autonomy-matrix

The AI security market is full of future-tense products, announced before they're built. These five questions separate what works today from what's promised. https://zeltser.com/ai-security-buying-questions

How can you turn raw malware analysis notes into a solid report? You can use my template yourself or point your AI agent at my MCP server to draft one with the template and my writing guidance. Your sensitive data stays local. https://zeltser.com/malware-analysis-report

Preparing to talk to a security vendor? Cyber Company Profiles gives you an independent read of its market position and product strategy, built on the questions I kept asking as a buyer and product leader. https://zeltser.com/cyber-company-profiles

Shopping for AI security products gets confusing fast, so I put together a short field guide that maps the market's product types and what to check in each. https://zeltser.com/ai-security-market-field-guide

My new report template helps malware analysts organize and communicate their findings. It draws on my own experiences and established frameworks such as the Malware Behavior Catalog, for credible reports. https://zeltser.com/malware-analysis-report

Each of my executive-briefing templates answers what senior leaders actually ask. What happened, what it means for the organization, and what we should do. They're based on what I wanted to see and share as a CISO. https://zeltser.com/cyber-brief-templates-for-decision-makers

The contested areas of AI security formed around the newest asset classes, such as runtime AI data and AI agent identities, where startups and incumbents compete. Acquirers have absorbed over one in ten products in the AI Defense Matrix Catalog. https://zeltser.com/ai-security-market-shape

I launched Cyber Company Profiles to analyze the market position and product strategy of hundreds of cybersecurity companies. Same questions, same scales, so you can compare vendors and go deep, instead of collecting one-off AI answers. https://zeltser.com/cyber-company-profiles

I put together four templates for briefing executives about cybersecurity matters, covering a threat campaign, a celebrity vulnerability, an incident, and a security assessment. Customize them to your own needs. https://zeltser.com/cyber-brief-templates-for-decision-makers

When everyone's attention is on a celebrity vulnerability, you can organize your investigation and share findings using my new template. It's AI-friendly, of course. https://zeltser.com/high-profile-vulnerabilities

Sounil Yu and I mapped security-for-AI products to create the AI Defense Matrix Catalog. Almost half protect runtime AI data, yet over a quarter of the matrix is empty. Products cluster where technology can do the work and thin out where people do. https://zeltser.com/ai-security-market-shape

Attackers and their malware can turn our trusted tools against us to steal API and SSH keys. In the s1ngularity attack, hijacked AI coding agents combed developer machines for such secrets. Here's how to minimize our exposure. https://zeltser.com/securing-api-keys-on-your-workstation

If you help secure AI, whatever your title, Sounil Yu and I have ten quick questions for you. Anonymous, mostly checkboxes. We'll share the analysis, so the more practitioners respond, the more useful the benchmark becomes for everyone. https://zeltser.com/ai-security-survey

Third-party keyboards can leak our keystrokes even when the developer isn't malicious. A supply chain attack can hijack a legitimate app, and weak engineering and security practices can expose highly sensitive data. https://zeltser.com/third-party-keyboards-security

I created a short template for capturing and communicating details about a high-profile vulnerability. It helps you share your findings with internal stakeholders and is a starting point for external comms. https://zeltser.com/high-profile-vulnerabilities

Security leaders are making AI security decisions with almost no data about what their peers are doing. Sounil Yu and I built a five-minute anonymous survey to change that, and we'll publish the findings so you can benchmark your approach. https://zeltser.com/ai-security-survey

I've seen too many author-centric assessment reports, full of stories of conquest and irrelevant details. The best reports are reader-centered. My new template offers a consistent way to write them that way. It's AI-friendly, too. https://zeltser.com/security-assessment-report-template

A decade of CA failures could have collapsed the web's certificate trust model, but they didn't. Browsers and CAs addressed each failure with a structural fix, and the same approach applies wherever you delegate trust. https://zeltser.com/past-present-future-web-trust-model

Sounil Yu and I built the AI Defense Matrix, an approach for deciding how to defend the various AI systems in your environment. Here's why. https://www.sans.org/blog/why-sounil-yu-i-built-ai-defense-matrix

AI capabilities of keyboard apps (rewrites, voice transcription, generative writing) entice us into letting our keystrokes float to the developer's servers. That makes each one a keylogger we authorized, with safeguards left to the developer. https://zeltser.com/third-party-keyboards-security

My new template for security assessment reports offers a structured, repeatable approach to communicating with readers. It's based on my experience creating and reading many such reports over the years. It's AI-friendly, too. https://zeltser.com/security-assessment-report-template

How can you use your AI agent to transform raw threat notes into a well-sourced CTI report draft? Use my MCP server with my new CTI report template and writing guidance. Your sensitive data stays local. https://zeltser.com/cyber-threat-intel-report-template

Observability, short-lived credentials, and active enforcement held the web's certificate trust model through a decade of CA failures. The same three levers work anywhere you delegate trust, from code signing to identity federation. https://zeltser.com/past-present-future-web-trust-model

My new template for cyber threat intelligence reports covers tactical, operational, and strategic aspects of threat activity. A companion brief captures the key takeaways for decision-makers. You can also use it with your AI agent. https://zeltser.com/cyber-threat-intel-report-template

Threat attribution works at 3 levels: Tactical examines the incident, operational characterizes the campaign, and strategic asks who's responsible and why. Disciplined analysts weigh the same 6 signals at every level. https://zeltser.com/six-signals-for-threat-attribution

Every domain has its Turbo Encabulator. The more expert we feel, the more fluently we explain something that doesn't exist. https://zeltser.com/experts-overstate-expertise

This template for a security incident report not only helps with documentation, but also offers guidance when capturing findings during the incident. Take it, customize it, use it. https://zeltser.com/incident-response-report-template

Plant a decoy persona, such as a fake LinkedIn profile or an unused directory account, to catch attackers reaching for what they think is real. The decoy has no production use, so any interaction is a high-confidence alert. https://zeltser.com/the-notion-of-a-honeypot-persona

We read more threat attribution claims than we make. Six signals separate the ones that hold up from the ones that don't, and analysts weigh them together to build a defensible case. https://zeltser.com/six-signals-for-threat-attribution

Letter grades tied to specific criteria influence business' behaviors, as NYC's sanitation labels have shown. Cybersecurity is starting to follow with the Cyber Trust Mark for IoT, but the consumer web hasn't caught up. https://zeltser.com/restaurant-inspections-as-security-validation-model

A decoy persona alerts you when an attacker probes your directory or public profiles. When they can't tell the bait from real identities, you create an asymmetry that gives you the upper hand. https://zeltser.com/the-notion-of-a-honeypot-persona

"The career-shaping work happens in the years before the job search." 100% We're seeing others say the same things albeit in other areas, such as leadership

The career-shaping work happens in the years before the job search. Reputation, relationships, and visible work are what land the right role. The resume's job ends at initial screening. https://zeltser.com/stop-relying-on-your-resume

Having interviewed many candidates, I can tell within minutes whether someone prepared for the discussion. A few hours of focused prep often makes the difference between getting the offer and getting a polite no. https://zeltser.com/interviewing-tips-for-it-job-candidates

The REMnux MCP server can now draft malware analysis reports using my new report template: https://zeltser.com/ai-malware-analysis-remnux

Self-hosted Algo on DigitalOcean lets us treat the VPN exit IP as disposable. After investigating malicious infrastructure, destroy the droplet, redeploy in minutes, and the next project starts from a clean IP. https://zeltser.com/deploy-algo-vpn-digital-ocean

I updated my cheat sheet for creating cybersecurity assessment reports. It's a one-page doc, which you can customize: https://zeltser.com/security-assessment-report-cheat-sheet