The AI-driven surge in vulnerability discovery and exploitation has begun. Three indicators from the past few weeks: 1. chatter that incident response firms are fully booked and overwhelmed with business (meaning breaches are happening even if we don’t see headlines) 2. a major certificate authority compromise (eMudhra) 3. the massive PHP vulnerabilities discussed today (CVE-2026-109618 and CVE-2026-109619) AI is either directly discovering the vulnerabilities or is a means to rapidly exploit the issue at scale and low cost. The combination of low cost and scale means industries that skated under the radar because of attacker interest / ROI are now squarely in the attack crosshairs. This applies to all companies, big and small. You are not safe because “hackers won’t come after industry XYZ”. They will. The defensive needs are clear. We need to migrate from human-driven cyber defense to defense at the speed of computers. This is the position I laid out in December when I spoke to the House Homeland Security Committee subcommittee in DC about the threat of AI-powered cybersecurity attacks. What should organizations do today? This is not an exercise in being clever. Rather the need is to be comprehensive. 1. Understand your exposure - Establish an automated inventory of your packages, libraries, operating systems, full tech stack, etc. 2. Understand when you need to respond - Build automated monitoring systems that monitor public CVEs and cybersecurity chatter and cross-reference this with your inventory. Response time is moving from days to hours to minutes. You need automation and alerting. 3. Mobilize and plan for response - The issue will inevitably hit at 2am. How will you mobilize the right team members? Can you bring the system offline in moments (operationally, and do you have internal authorization)? What team members are needed? Do you have reliable paging and response? Practice now. 4. Reduce Attack Surface & fix issues you can now - AI chaining is increasingly tying together otherwise low-risk issues into critical outcomes. This means you either need to comprehensively analyze all known vulns to better understand if a low is actually a high risk issue. Or, lacking this capability, be more aggressive to fix known issues. One simple way to fix issues - remove the access and exposure. A device that can’t be reached is much harder to exploit! This is not business as usual. Your cybersecurity posture and strategy over the next 18 months are an opportunity to survive when your competition fails (and they may no longer be a competitor at that point). If you’ve been saying “We take cybersecurity seriously...” This is your chance to put your money where your mouth is.

Big Update for me - a new chapter and I'm now CISO of @SolanaFndn . I've always been drawn to fast moving new frontiers. Head of Security of Mozilla during the height of the browser wars, the first CISO of Twitter as they burst onto the world's stage, and even as a startup founder innovating on data security for enterprise SaaS as cloud deployments skyrocketed. Years ago through the acquisition of our startup, Altitude Networks, to CoinList I found my way into crypto. I'm excited to share that I'm continuing the crypto adventure as CISO of Solana Foundation. Why Solana? This is the chain doing tens of billions of dollars in stablecoin volume a day. It's the chain where SpaceX's tokenized shares went live the same day as its Nasdaq debut. It's processing more transactions daily than most of crypto combined. Solana is establishing itself as the future of financial infrastructure, at massive scale. Now, this is not without its challenges. I'm keenly aware of the adversaries' incentive to separate people from their crypto. I'm aware of the rising threats from malicious use of AI (something I testified to Congress about earlier this year), and the massive power for defense when harnessed effectively. And I’ve felt the push and pull when innovative new approaches meet established traditional businesses. I'm thrilled to work across the foundation and the entire Solana ecosystem to help tackle these challenges head on. That means building security into this industry, from operational and appsec fundamentals to the crypto-specific challenges, working with policymakers and standards bodies to get cybersecurity regulation right, and bringing the lessons and battle scars I've picked up along the way. Innovation is messy and security is hard. This is the nexus where I enjoy working to solve the hardest challenges alongside the smartest folks around the world. Onward!