I’ve been seeing the same anti-pattern everywhere lately.
Someone opens Cursor, Copilot or Claude and pastes a giant prompt:
Tag Archives: cyber
Bridging the Cybersecurity Gap for SMBs
I recently joined the MSP 1337 podcast with Chris Johnson to talk about something I’ve been thinking about for years:
Small and midsize businesses are being asked to operate with enterprise-level security expectations — without enterprise-level resources.
That gap is becoming impossible to ignore.
And AI is accelerating both sides of the problem.
Attackers are moving faster.
Infrastructure is becoming noisier.
Compliance requirements are multiplying.
Meanwhile, SMBs and MSPs are still expected to somehow manage everything with limited staff, fragmented tools, and endless alerts.
That model is cracking.
Btw, you can listen to it here:
– Apple Podcasts
– Spotify
Using LLMs to Find Security Bugs: A Practitioner’s Playbook
TL;DR
LLMs won’t replace AppSec.
They will dramatically compress the search space.
If you use them right:
- Run multi-model analysis (Opus + GPT + Gemini)
- Structure prompts around attack surfaces, not “find bugs”
- Require PoCs or tests for validation
- Trust only cross-model consensus or reproducible exploits
If you don’t do this, you’ll drown in false positives.
Security research has always been asymmetric.
Attackers need one bug; defenders need zero.
Historically, scale worked against defenders.
LLMs start to rebalance that—not by magically finding zero-days, but by acting as a fast, always-on analyst that can:
- Read entire subsystems in seconds
- Connect logic across files
- Generate realistic attack paths
Used correctly, they don’t replace expertise—they let you spend it where it matters.
Used incorrectly, they produce confident nonsense.
This is a practitioner’s workflow that actually works.
Simple Steps to Protect Your Business from Ransomware
There’s a new ransomware playbook.
It doesn’t try to evade your security tools.
It just kills them.
Attackers are using BYOVD (Bring Your Own Vulnerable Driver):
- They load a legitimate, signed Windows driver
- Exploit it to get kernel-level access
- Then shut down your EDR/antivirus like any normal process
No alerts. No resistance. Just silence.
From there, encryption is trivial.
This is already being packaged into single payloads:
break in → disable security → encrypt
All in one move.
Execution time: minutes, not days.
The uncomfortable truth:
“We have EDR” is no longer a security strategy.
Attackers don’t need to bypass your defenses anymore.
They just turn them off.
Ido Green 