Promptly Secured A security chief and his AI crew

About: twenty years on both sides of security

When I started, security meant a locked server room and a well-hidden password. Today the way in can be a fridge, a delivery app or a fake voice on the phone. In twenty years I've been a sysadmin, a tester with an attacker's eye, a SOC builder and a security chief. The question on my mind now: what does a security chief do with all that knowledge once it no longer fits into one person's day?

The road so far (20 years, condensed)

  1. Péter – White

    Sysadmin

    More than fifty servers, over a hundred workstations, several sites. This is where I learned that the most common incident report starts with: "I didn't touch anything."

  2. Red + Péter – White + Blue

    Security admin in the financial sector

    This was the first time I got paid to build systems that protected the company from something I didn't yet fully understand myself. Firewalls, intrusion detection, vulnerability management. Then came a few ethical hacking engagements, and I started to understand what we were actually defending against.

  3. Péter – White

    CISO at an international automotive group

    A short but instructive detour. I learned that in a multinational automotive environment, even the security policy has a turbo mode.

  4. Red + Péter – White + Blue

    Building a SOC from zero

    As lead information security expert, then SOC lead, in the financial sector. Team, processes, tools, mentoring program. Zero was the easy part. Then the whole thing had to be steeped in ethical hacking too.

  5. Péter – White + Blue

    SOC director, EMEA

    At an international security provider, I built the region's SOC team, working with clients and with the other SOCs around the world.

    • I came to understand that "follow the sun" means the sun never sets, and neither do the alerts.
    • I also learned that a Panama shift does not mean we occasionally run an exchange program with our South American colleagues.

  6. Péter – White

    Security chief (CSO) in the financial sector

    Cyber security, compliance, physical security, business continuity and crisis management, all on one desk. "Crisis management is on my desk too" is not usually meant as a reassuring sentence.

  7. Red + Péter – White + Blue

    Promptly Secured

    The future, or perhaps already the present: on the battlefield of information security, AI fights AI. This experiment is my first step to find out whether AI can be an effective help not only on the attacking side.

Acronyms collected along the way: CISA, CISM, CEH and OSCP. The first three certify that I know how it should be done. OSCP certifies that I can actually do it.

Why I do this

  • Security for everyone. For decades I talked about security to people whose job it is. Now I want to talk to those whose job it isn’t.
  • To keep myself up to date. Every topic we cover here teaches me too. A selfish reason, but an honest one.
  • A public experiment. I’ll show where AI speeds things up, and where it’s wrong with such confidence that it’s almost charming.

What I promise

  • I review everything. The AI crew collects, analyzes and translates, but nothing goes out without my review and my own contribution.
  • I bring AI into every step. From research to translation, the crew works on everything, and at the end of every post you’ll find what the crew did and what I did.
  • Education only. Not even Red hands anyone a working attack tool. The experiments run in my own lab, on my own equipment.

What you won’t find here

This is my own playground, independent of every workplace I’ve had. Nothing published here comes from my current or past employers, covers the tools or internal matters there, or represents any of their views. What you read here is my personal opinion only.