Security Boulevard

What Are Non-Human Identities in Cybersecurity? Have you ever considered the significance of a “passport” in digital identities? In cybersecurity, Non-Human Identities (NHIs) play a similar role. They are akin to machine passports, ensuring secure interactions in digital environments. But what exactly are NHIs? They are machine identities used to manage identities and secrets within […]

The post How are NHIs driving innovation in cybersecurity appeared first on Entro.

The post How are NHIs driving innovation in cybersecurity appeared first on Security Boulevard.

What Role Does AI Ethics Play in Building Trust in Autonomous Systems? How can AI ethics shape the trust we place in autonomous systems? This question lies at the heart of a rapidly evolving dialogue within data management and cybersecurity. When organizations integrate machine identities and secrets security management into their cybersecurity frameworks, the ethical […]

The post How does AI ethics influence trust in Autonomous Systems appeared first on Entro.

The post How does AI ethics influence trust in Autonomous Systems appeared first on Security Boulevard.

Author, Creator & Presenter: Hoss Shafagh, Netflix

Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) content on the Organizations' YouTube Channel.

Permalink

The post USENIX Security ’25 (Enigma Track) – Trust Agility In An Era of Transient Ties: Rethinking TLS Trust In A Rapidly Evolving Ecosystem appeared first on Security Boulevard.

The Trump Administration released is long-anticipated national cybersecurity strategy that calls for an aggressive approach to attackers, use of AI and quantum, and protecting critical infrastructure. It's full of rhetoric and proposals, but is short on details.

The post Trump Administration Lays Out a High-Level Strategy to Combat Cybercrime appeared first on Security Boulevard.

A deep dive into Iranian cyber warfare and actionable defenses for network operators.

The post Securing Critical Infrastructure in a Time of War appeared first on Security Boulevard.

The Developer's Practical Guide to Passwordless Authentication in 2026

The post The Developer’s Practical Guide to Passwordless Authentication in 2026 appeared first on Security Boulevard.

Are Your Non-Human Identities Leaving Your Cloud Environment Vulnerable? Understanding the significant challenges faced by organizations in managing Non-Human Identities (NHIs) and Secrets Security Management is crucial. One might ask why these concerns have gained prominence. With industries increasingly embrace digital transformation, these machine identities have become critical components in cybersecurity, creating unique challenges and […]

The post What makes secrets management key to safe Agentic AI appeared first on Entro.

The post What makes secrets management key to safe Agentic AI appeared first on Security Boulevard.

Are You Confident in Your NHI Lifecycle Strategy? The advent of cutting-edge technologies in cloud environments has accentuated the importance of Non-Human Identities (NHIs) in cybersecurity. Why do NHIs matter so much, and what steps can organizations take to establish a confident and comprehensive NHI lifecycle strategy? The answers, while not always simple, lie in […]

The post How do I build a confident NHI lifecycle strategy appeared first on Entro.

The post How do I build a confident NHI lifecycle strategy appeared first on Security Boulevard.

How Can Organizations Effectively Protect Non-Human Identities Online? Are your machine identities adequately protected against cyber threats? Where the integrity of digital identity is paramount, the protection of Non-Human Identities (NHIs) requires more than just a basic understanding of cybersecurity. NHIs, integral to online security, demand a comprehensive approach to ensure their protection across diverse […]

The post What methods ensure NHIs are fully protected online appeared first on Entro.

The post What methods ensure NHIs are fully protected online appeared first on Security Boulevard.

Why Small and Mid-Size Businesses Need CIAM in 2026 (And Why the Cost Objection No Longer Holds)

The post Why Small and Mid-Size Businesses Need CIAM in 2026 (And Why the Cost Objection No Longer Holds) appeared first on Security Boulevard.

Author, Creator & Presenter: Bolor-Erdene Jagdagdorj, Microsoft AI Red Team, Auto-Dubbed For Some Languages Was Automagically Generated

Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) content on the Organizations' YouTube Channel.

The post USENIX Security ’25 (Enigma Track) – AI Red Teaming And Automation: Exploring Societal Risks In GenAI appeared first on Security Boulevard.

AI Auditability: Why Leaders Must Prove How AI Makes Decisions We’ve officially entered the “production phase” of Artificial Intelligence. In just a few short years, AI has moved from experimental pilots to being embedded in nearly every major business function—by some estimates, used regularly by 88% of organizations. But there is a growing, uncomfortable truth […]

The post AI Auditability: Why Leaders Must Prove How AI Makes Decisions appeared first on Cyber security services provider, data privacy consultant | Secureflo.

The post AI Auditability: Why Leaders Must Prove How AI Makes Decisions appeared first on Security Boulevard.

In the fast-evolving world of banking, where digital transformation drives operational efficiency, the security and reliability of IT systems have become a key to organizational success. System audit reports have emerged as a critical tool to ensure that banks operate efficiently, securely, and in compliance with stringent regulatory standards. These reports provide a comprehensive assessment […]

The post System Audit Reports in the Banking Sector: Key Expectations appeared first on Kratikal Blogs.

The post System Audit Reports in the Banking Sector: Key Expectations appeared first on Security Boulevard.

Can Agentic AI Innovate Security Frameworks for Non-Human Identities? Where organizations grapple with digital transformation, one question looms large: Can leveraging Agentic AI revolutionize how we manage security frameworks, particularly for Non-Human Identities (NHIs)? The integration of advanced AI solutions into cybersecurity strategies has become imperative. The Need for Reinventing Cybersecurity with Agentic AI Agentic […]

The post How do Agentic AI systems enhance security frameworks appeared first on Entro.

The post How do Agentic AI systems enhance security frameworks appeared first on Security Boulevard.

Are Non-Human Identities the Missing Piece in Your Cybersecurity Strategy? What Are Non-Human Identities, and Why Are They Important? Have you ever considered the security implications of the digital identities and credentials your machines hold? The rise of Non-Human Identities (NHIs) is reshaping cybersecurity. These machine identities serve as essential components for securing modern digital […]

The post Can AI-driven security solutions fit small business budgets appeared first on Entro.

The post Can AI-driven security solutions fit small business budgets appeared first on Security Boulevard.

What Does It Mean to Manage Non-Human Identities Effectively? Imagine where every digital entity, from simple applications to complex systems, functions like travelers in an international airport. If human identities are the passengers, then non-human identities (NHIs) are the technical travelers. Their management involves a passport-and-visa approach to cybersecurity, where NHIs use encrypted secrets as […]

The post How well can Agentic AI handle complex security needs appeared first on Entro.

The post How well can Agentic AI handle complex security needs appeared first on Security Boulevard.

Millions installed 'productivity' Chrome extensions that became malware after acquisition. Here's how browser extensions became enterprise security's weakest link.

The post The Chrome Extension Backdoor: How ‘Productivity Tools’ Became Enterprise Attack Vectors appeared first on Security Boulevard.

The FBI, CISA, and NSA reportedly are investigating the hack by an unnamed "sophisticated" actor of a FBI surveillance system that holds sensitive information. The breach carries the hallmarks of Chinese nation-state groups and comes amid concerns about attacks in the wake of the war against Iran and the shrinking of the federal cybersecurity apparatus.

The post FBI is Investigating the ‘Sophisticated’ Hack of Its Surveillance System appeared first on Security Boulevard.

From the Battlefield to the Boardroom: Lessons in Defense

In the latest episode of The Defender’s Log, host David Redekop sits down with Steven Elliott, CFO of Adam Networks, to explore the surprising parallels between military operations, financial management, and cybersecurity.

A Journey of Unpredictable Paths

Elliott’s background is anything but linear. From a small farming community in Kansas to studying international business, his trajectory shifted on 9/11, leading him to enlist in the 75th Ranger Regiment. Following his service, he navigated the 2008 financial collapse as a wealth manager before transitioning into the tech sector.

Core Principles of Defense

Drawing from his time as an Army Ranger, Elliott emphasizes that defense must always precede offense. He introduces several “priorities of work” that translate directly to the digital world:

• Establish Security First: You cannot project power without a secure perimeter.
• Maintenance is Critical: If your “weapons” (or software) don’t work, you can’t fight.
• Avoid the “Hurry to Die”: Fear-based decision-making often leads to catastrophic errors.

The Human Element

Elliott shares a moving account of a friendly fire incident in Afghanistan—involving teammate Pat Tillman—to illustrate a vital leadership lesson: bad news does not get better with age. He argues that transparency and relationship-building are the ultimate safeguards against systemic failure.

In an era dominated by AI and complex digital threats, Elliott’s message is clear: focus on character, trust your team, and operate with curiosity rather than fear.

Full episode of The Defender’s Log here:

Defense Before Offense: Leadership, Risk, and the Cost of Bad Decisions | Defenders Log

TL;DR

• Defense First: You cannot move offensively without a secure perimeter.
• Military “Priorities of Work”: 1. Security, 2. Maintenance, 3. Personal Care, 4. Sleep.
• “Don’t be in a hurry to die”: Decisions made from fear or anxiety lead to catastrophic errors.
• Transparency: Bad news does not get better with age; honesty prevents organizational fragility.
• Lessons from Pat Tillman: The tragic friendly-fire incident highlights the danger of “spinning” narratives versus telling the truth.
• Tactical Pause: In the age of AI, choose curiosity over panic.
• People > Tech: Software is only as strong as the relationships and character behind it.

Links

View it on YouTube: https://www.youtube.com/watch?v=-u0Od3DIpjs

Listen to the episode on your favourite podcast platform:

Apple
https://podcasts.apple.com/us/podcast/defense-before-offense-leadership-risk-and-the-cost/id1829031081?i=1000753695988

Spotify
https://open.spotify.com/episode/5YR0baoCpjjuj6Jhdna9xW

Amazon Music
https://music.amazon.ca/podcasts/d7aa9a19-d092-42a6-9fe9-9e8d81f68d30/episodes/5d8e594e-d5a4-4cb7-804e-82fd56ec0334/the-defender%E2%80%99s-log-podcast-defense-before-offense-leadership-risk-and-the-cost-of-bad-decisions

ADAMnetworks
https://adamnet.works

The Defender’s Log Full Transcript -Episode 017

David Redekop: Deep in the digital shadows, where threats hide behind any random bite, a fearless crew of cyber security warriors guards the line between chaos and order. Their epic battles rarely spoken of until today. Welcome to the Defenders Log, where we crack open the secrets of top security chiefs, CISOs, and architects who faced the abyss and won. Here’s your host, David Redekop.

Welcome back to another episode of the Defenders Log. And I am very glad that Steven Elliott is able to join us today. He’s our chief financial officer at Adam Networks. And I’m very privileged to have gotten to know you, Steven. Welcome.

Steven Elliott: Thank you. Yeah, likewise. It’s great to be here.

David Redekop: When I first started the Defenders Log podcast, I thought, you know what, it’s just going to be people in tech and cyber. At some point, it became very obvious to me that there are so many analogies to the real world. There is a reason why I thought you should be on here today, and that is because the real world is always going to matter—and matter more, I think, than the digital world. There is a very strong defense analogy, especially given your background. As our audience knows, I live and work in Canada, but Steven is in the United States. We are true brothers in so many senses, and so that’s why I wanted to just have our audience get to know you a little bit. Steven, tell us how you got your start on this planet.

Steven Elliott: Wow. Uh, well, the short version: I was born in western Kansas, a small farming community called Hays, Kansas. If any of you have ever driven through on Interstate 70, you’ve probably gotten gas there at some point. It’s not known for too much else in the country, but it’s a great community, a great little town. So all my family, for the most part, are in some form or fashion attached to agriculture—farming. There’s a little bit of an oil industry there. That was the world that I grew up in in the 1980s.

Then I went to college at Oral Roberts University in Tulsa, Oklahoma. Studied international business. Didn’t really know what I wanted to do; didn’t really have a plan. If I didn’t have to have a financial justification for my education, I probably would have been just a history or an English lit major because those were the classes that I loved the most. But I didn’t want to be a professor, and I didn’t want to be a barista. No offense to those disciplines because they’re very necessary in our world.

I enjoyed business; there’s a historical aspect to business. Understanding history, I think, is important to seeing where it rhymes in our world. That aspect was always very interesting to me—just the decision-making piece of it. How can you understand numbers to make better decisions, etc. A lot of things about the business piece of it really resonated with me, but I didn’t really have much of a plan as far as what I was going to do with that.

Then my junior year of college was 9/11, and that altered my trajectory, as it did for a lot of people, quite a bit. I had family who had served in previous conflicts, including World War II. So I made the decision essentially to say, “I don’t know what I’m going to do as a career, but it felt like between where I was at in college and any other career, I really needed to spend some time in the military.”

So I did that. Three weeks after I graduated with my bachelor’s, I was at sunny Fort Benning, Georgia, and began a four-year enlistment in the Army. Then, having concluded that in 2007, I started as a financial adviser with what was at that time Citi Smith Barney. Little did I know that I was entering that industry about 12 to 18 months before a complete and near total financial collapse of the financial sector. So that was an interesting time to enter that world.

I spent from '07 to about 2022 in private wealth management. The latter part of that, I was running a trust company. We were administrating trusts and estates, which is kind of a second cousin to a more traditional financial planning wealth management relationship. Fascinating work. There are elements of relationship which are so critical. All of those documents—any legal document, really, whether it’s an operating agreement or whether it’s a trust or a will—it’s really only as good as the relationships that drafted it and signed it. You kind of get a seat at the table in a lot of those conversations where you see how those documents and agreements work well because the relationships work well, and then you also see where they don’t because of the relational discord.

So that was my journey prior to my intersection with Adam Networks, which was not at all on my bingo card, so to speak. I think it was probably 2017 or 2018 when I first met Francois Dery at an event in Seattle where it had nothing to do with cybersecurity. He was presenting a new film that he was working on at that time. I think he had started doing some work with Adam but still had his studio. We just started talking and struck up a friendship. Then he started telling me about this thing called Adam Networks and this guy he met called David. That was the beginning of my foray into the industry. That’s a lot of ground to cover, but that’s the overview as far as what’s brought me here.

David Redekop: I’m forever grateful for that event that Francois went to to find you and meet you, and for that connection that in hindsight is so obvious for us anyway. We are mutual benefactors of getting to connect with our own kind where the worldview is aligned in spite of a completely different background, different politics, different education, different area of specialty. There’s something that drew me to you immediately, and I suspect it would be the same for Francois. You have this very quick ability to take an otherwise complex idea and instantaneously synthesize it and make it a very palatable, easy-to-understand concept for any audience member.

I’ll give you a very specific example. I remember the first time we talked about company valuation, and you said it’s very simple: it’s the present value of all future revenue or future profit. I’m like, “Yes, of course.” I, of course, spent years in the present value and future value calculations to do fancy mortality tables to calculate what an annuity or a life insurance policy should cost or reward. And of course, it’s the present value of all future transactional value that makes the value. Ever since then, you’ve done that on a repeated basis.

I’m very grateful for that because as complex as technology is, one of the defensive elements is if you can make sense of it. When you can’t make sense of it, you are a victim or you are going to be a targeted victim. What I always appreciate about you is that your lack of wasted time on technical engineering is what gave you the advantage in actually understanding the macro.

Steven Elliott: Yeah, I think that’s probably true to some degree. I think I also had a lot of practice, which is always interesting to think about too. Making the switch from financial services to Adam Networks was easy in some respects because of the relationship and the trust and respect that I have for you and Francois and the rest of the team, really. It was just like, “Well, these are extraordinary people, and if my skill sets can serve this team and that means that I get to spend time with these people on a daily basis, well, that’s a really good thing.” If they happen to be selling cybersecurity software, fine, but that’s not really the point. It’s just more that there’s something of value that we can provide to the marketplace and these are good people to do it with.

Sometimes you look back or when you’re in the midst of life, you wonder if there is a trajectory here or am I just bouncing over here and doing this thing and then bouncing over here and doing that thing. You know that saying that life is lived forward but understood backwards. I think that’s very true, where you start to look back and you can see some threads.

One of the threads for what we were talking about was a senior adviser at the branch where I started in the industry. She was a wonderful mentor to younger advisers like myself. She gave me a book called Storytelling and it is particularly geared towards the financial services industry. Not unlike cybersecurity or technology, you want to talk about a black box lexicon. Most people who are making the buying decision—the retiree, whomever—they don’t know the difference between a SEP or a simple IRA or a call option. It’s just as confusing; it’s a different lexicon but it’s the same black box, which to some degree is necessary because it is a complex world. You do need to know the terms and you do need to have confidence in that. But in another degree, sometimes I wonder if we are making this more confusing on purpose. Sometimes it feels like we are.

So I was forced early in my career to have people who were helping me think that way. People were helping me really think in terms of: this is your audience. It’s a retiree from the state of Washington. They don’t know 5% of what you know about financial services, but that doesn’t mean they’re dumb. If you treat them with respect and if you work to try and find the language that they can speak, then you’re actually going to empower them to make decisions, which turned out to be a good business prospect.

It was also somewhat of a way of qualifying clients. Sometimes you’d have people come to you and they weren’t interested in a conversation. They weren’t interested in learning. They were just interested in, “I’m going to give you money and you’re going to go make me money, and if you don’t make me money, I’m going to fire you.” It’s like, “Well, here’s the thing: I don’t know what’s going to happen tomorrow in the financial markets any more than you do. I just don’t know. So my job is not to just blindly tell you what to do. It’s your money. It’s your retirement plan. It’s your estate plan. My job is to help educate you as to the risks and the rewards, and then you make the decision.”

That was really what my practice was built around. But I had a lot of really good help. I think that started me early on and it set me up well for the transition into cyber—thinking that way. The challenge is that then entering this industry, which I basically entered about seven years ago on a part-time basis with Adam and then full-time for four years now, I was the person who didn’t know anything. In order for me to level-set and be able to even understand a P&L and balance sheet—that’s fine—but I’ve had to really drink from a fire hose to just be conversant from a business standpoint. Not trying to know what you and our engineers know; that’s not necessary. But it really has been a challenge, and you guys have been really good teachers. That helps a lot—to have people who can help guide you through it. It gave me a lot more appreciation for the times when I was a young adviser stuck in finance speak and I just kind of shook my head and thought, “You didn’t have to say all that.” I’ve definitely learned a lot and I continue to learn a lot. So, thank you guys for being teachers.

David Redekop: No, I mean, I remember the first time that you were interviewed on the Cube and I thought, “Well, what’s he going to say?” And then afterwards, I was just like, “Whoa, we don’t need any engineers to ever show up on camera again. We’re just going to send Steven everywhere.” So, you clearly were a good student. Francois is a very good teacher on the communication side. That’s partly what gives the three of us some resilience in that none of us have the exact same strengths. There’s some overlap, of course, and that’s what you really want in a leadership team that has as important a mission as we do.

I want to switch gears for just a little bit, Steven, to the military experience that you have and the defensive role in there. Before we go into that, from the perspective of Canada and other countries, I do feel that this is an opportunity to share that most Canadians, I believe, would understand that we do owe a good chunk of our freedom and our liberties to the fact that we ourselves as a country have experienced a good solid defense because of who our neighbors are. Being part of the world’s longest undefended border, with most Canadians living within 100 miles of that border and having the relative peace that we’ve had for so long, is because of the US military.

There is a picture that enters my mind of the fact that military power has been there, and even though it could be used even more than it has been, it is because of that that we are as safe as we are. For that, I am personally grateful. Coming from a Mennonite background in the last number of centuries, our antecedents felt that we wouldn’t participate in war. In fact, it was very often the reason our antecedents left for another country—in order to avoid being drafted—because the notion of killing another human being or somehow assisting was contrary to what our antecedents believed. All that to say, thank you for what America and folks in the military have done in the US and in Canada too to give us and our children their freedom and the liberty to live out lives that we feel that we must do but we don’t have to go to bed being afraid. But let’s now switch to your defensive time that you had in the military. Tell us a little bit about that—what that experience was like.

Steven Elliott: Yeah, so I went in enlisted. I had a college degree; I could have gone in as an officer. But the fastest pathway in the United States Army to get into a special operations unit was the enlisted pathway. If I went in as an officer, it was going to be a lot more time in the schoolhouse. I wasn’t sure if I wanted to make the military a career. I also at the time—which is quaint to think about—I didn’t know how long the war was going to last. Previously, deployments—the last war that the United States had fought that was an actual, not a low-level conflict, was the first Gulf War, and that was more or less over in 60 days. So I was in a hurry to find my way into the fight, so to speak.

I joined with a Ranger contract and completed all of the selection and everything to serve in the 75th Ranger Regiment. Specifically, I served at 2nd Ranger Battalion up at Fort Lewis, Washington. So I went from business school to being a member of the Ranger machine gun teams. The way the Ranger Regiment is organized, it’s organized the same way as essentially any light airborne infantry unit in the US military is. It’s a similar organizational structure.

Regardless of whether you’re in a special operations unit or not, there are certain military principles that always apply. You can’t project offensively if you do not have a secure perimeter. In Army or Ranger speak, one word picture: if you have a platoon of folks walking around in the woods and you stop and you’re going to sleep, the first thing you’re going to do is form what’s called a patrol base. And that’s going to be a triangle. It’s a perimeter. Machine guns are on every corner. You’re going to make sure you have overlapping fields of fire. You’re going to make sure that you’ve got proper distance between the perimeter. Then you revert to your priorities of work.

That’s always one of the most fundamental things in the Army: your priorities of work, which are basically the things that you have to do that nobody should tell you to have to do. It’s almost like a part of your general orders. That is always, first and foremost, security. Establish security, even if it’s just you and one other guy. The first thing you do is somebody is on security. Then it’s weapons maintenance. You can’t fight if your weapons don’t work; that’s a problem. Then it’s take care of yourself. At the very bottom of the list is sleep. Those are your priorities of work that you’re always tied into.

It definitely crystallizes in a very visceral way the balance between doing something that is inherently risky. If you’re doing a raid or if you’re going out on patrol, you are taking risk. It is less risk to stay inside the wire than it is to go outside and try and knock down somebody’s door. But how do you reduce exposure? How do you operate as smartly and as safely as possible so that taking that risk, you reduce as many variables as possible?

Because I think that’s the other thing that is true in life, but certainly true in business and very much true in military operations: the enemy gets a vote. Meaning, the process you go through to plan for an operation—the value in that isn’t so much that you have a perfect, tailored, flawless plan. You know that plan is going to be subverted in some way, shape, or form. You’re going to get there and what you thought was on target isn’t on target, or an airplane’s going to break, or something’s going to happen. If that “something is going to happen” is just baked into the expectation, then the planning value is primarily about the process.

It’s primarily about the fact that, okay, I know things are probably going to go sideways in a way that I don’t even know they’re going to go. Nobody does. But we’ve gone through this process together collectively. I generally know where people are. I generally know what’s supposed to happen. I certainly know what the objective is. So that makes you more equipped. Knowing those pieces of information about the plan actually equips you for the inevitability of things going sideways because then you have the right data set, hopefully, to then be able to make decisions in the moment that were nowhere in your plan.

I was not in a senior leadership position at all. I was very much somebody in the line. But from regimental commander down to a Ranger private, in order for that unit to function, you still have to have buy-in and competency and everyone doing their job to the best of their ability, regardless of the rank on their collar. I definitely had a lot of experience learning that in an environment where if you don’t learn it quickly, the retribution is pretty swift. They will help you learn it very quickly.

David Redekop: Defense always before offense. There’s just like that analogue comparison to the cyber world. There’s many others. Now, sometimes I know that when we take an offensive approach and we have all circumstantial data that points to what we need to do, we can still make mistakes. Did you have any experiences like that in your life in the Army?

Steven Elliott: Yeah, very much so. Back in 2004, when we were deployed to the Afghan-Pakistan border, it was sort of an in-between phase in the war where the initial objective to eradicate the Taliban had more or less been accomplished. The Taliban was a non-entity in Afghanistan at the time, but there was still this mission to find Osama bin Laden, who had fled to Pakistan. We couldn’t go into Pakistan. So we were sort of left at that time with, if you’re going to do that, you would continue to deploy troops forward, hoping to run into him or run into somebody who knew where he was.

We were doing raids and patrols in Khost Province. Depending on whose Garmin you were looking at, we were in Pakistan some days because that border is not super defined. But that’s where we were. One particular incident occurred where essentially our platoon, which is about 35 guys, was asked to do two things simultaneously, and neither of them were mission-critical. Neither of them were time-sensitive. But because the order was given at the objection of our platoon leader, who was the person on the ground qualified to lead the platoon—he had a lot of experience he had to have in order to be in that role—he gave alternatives to say, “Well, if you want to accomplish X, we can do that, but I don’t have to split the platoon to do that. If I split the platoon, the platoon can’t talk to each other because the radios are line-of-sight; they’re not going to work in the mountains. If I split the platoon, I split the combat power.”

There are just a lot of things where, what I was talking about before, you’re already doing something that’s risky, so you need to find ways to de-risk it whenever possible and certainly not make decisions that make your organization inherently more fragile. But he was overruled and our platoon was split to do two different things. There was not a whole lot of happiness about that within the ranks. We all knew that this was kind of dumb, what we were being asked to do and the constraints of time that were being put around it.

To make a long story short, our element of the platoon was passing through a very narrow canyon, and we were ambushed. We were lucky to make it out of that particular kill zone. As we came out of it, there were more muzzle flashes on the hillside, and it appeared that we were being fired at by an enemy force. The leader on our vehicle fired, and then three others of us also fired. We were the first vehicle coming out of the canyon. Based on the information you have, you think, “Well, that’s an enemy position. Clearly, if I don’t fire, potentially somebody pops up and shoots somebody behind me.” In a very short amount of time—a matter of seconds—you make that decision.

Come to find out—we knew all this the following day—those muzzle flashes and the folks that we saw were at dusk. We didn’t have night vision because it wasn’t quite dark enough for night vision, but also the lighting conditions were poor. We’d been in a canyon shooting our weapons for 15 minutes, so we couldn’t hear anything. In any case, the rounds that we fired at the very end of that ambush were on the other half of the platoon. We had four casualties: 2 Kilo [Killed in Action] and 2 wounded. All that was as a result of friendly fire.

It’s certainly not common, but it’s not uncommon. It’s certainly something that more often than not literally gets covered up within the military because it’s not fun to talk about. Usually, when you have a friendly fire incident, it’s not just the decision that a shooter or a pilot makes in the instant that is the problem, although that’s part of it. It’s also why they were in that position in the first place? Why was the platoon split? Why couldn’t they talk to each other? Why was the risk amplified? Was that necessary?

It was certainly a lesson. We debriefed it and gave our statements. It was unequivocally known by everybody that it was friendly fire within 24 hours. There was no cover-up on our part. We were back out doing raids shortly thereafter until we came home. But that incident on multiple levels offers a lot of lessons. One of them is, at the very least, just from a leadership standpoint: it’s really easy when we get scared or when we get insecure and we just want to make things happen because if that box is checked on my list, that will quell my anxiety and I’ll just feel better that something’s happening.

Another saying in the world that I inhabited was “don’t be in a hurry to die.” Especially in that context, fight or flight kicks in. Your job is not to—and this is true in I think any leadership role, whether you’re a parent, a business leader, whatever role where you’re exercising some leadership in a world that is uncertain and has risk—oftentimes your first instinct isn’t necessarily the right one. It could be, but time is probably the most valuable resource any of us have.

We see that in the financial markets. If I want to buy an option on Apple, the price of that option for three years is going to cost me a lot more money than the price for three days because I have time. There’s time for something to happen. Part of the lesson there is, as a leader, number one, you have to trust the people you’ve hired. If you’re sitting not on the battlefield and somebody who is on the battlefield is saying, “This is a really bad idea,” you either need to listen to them or, if you’re not going to listen to them, then you should probably fire them. Why are they there? If they can’t exercise the authority that they’ve been given, then that’s the markings of some level of dysfunction. That was unfortunately part of the failure of that day—just a situation that was unnecessarily created where the risk was heightened.

Then you have to live with—I mean, that’s the reality too. It’s not simply to sit and blame an officer who’s in a TOC [Tactical Operations Center] someplace. You’re the one there; you’re the one who pulled the trigger. It’s also just a lesson in—it’s oversimplification to some degree, but—it really is just a lesson in forgiveness. It’s a lesson in the idea that—and that’s very severe; most people are not going to be in that situation. I’m not going to be in that situation just living my life every day right now when I’m not in the military. But it definitely illustrates the fact that, try as you might, things on some order of magnitude will go wrong.

There’s going to be a need in life to forgive yourself and forgive others because if you don’t do that—and it doesn’t mean that forgiveness means the thing didn’t happen and you just pretend like it didn’t. Forgiveness doesn’t mean that there isn’t remorse. Forgiveness doesn’t mean that you don’t need to apologize to other people. It doesn’t mean that that doesn’t need to occur; it absolutely does. But essentially, if you don’t do that, then—another saying that certainly rings true in my life—“unforgiveness is like drinking the poison expecting it to hurt your enemy.”

I think that’s true from my own experience. I carried around a lot of guilt, a lot of shame, and a lot of just pure hatred for people who put us in that situation because even the objectives—it wasn’t like “split the platoon because Osama bin Laden’s over here and another terrorist is over here and you’ve got to go get them.” That’s one thing, but that’s not what this was. You look at that and you say, “Well, this was pointless. What do we have to show for it?”

That’s a process that doesn’t happen overnight in terms of healing from that. But there’s been a lot of really great things that have happened in spite of that tragic event. I think maybe the other lesson too is allow yourself to be surprised. When things like that happen—when the worst, whatever that is, happens: your business fails, your marriage falls apart, the diagnosis comes through that you don’t know what you’re going to do with—that isn’t the end of the story, even though it feels like it. It feels like the weight has been [too much], the door has been clamped shut, and that’s it. The reality is I don’t think that’s ever true.

I’ve experienced that over the last 20 years. This last fall, I got to spend a few days with my former platoon mates. We had a reunion at Fort Lewis. The current members of our platoon hosted us, which—man, if you want to feel old, go back and see 21-year-olds who are fired up and super fit and ready to conquer the world. Really, really great guys. But then you sit with people that, if you would have told me even five years ago that I would be sitting and hanging out with some of these guys… just because there was so much pain and so much weight that was associated with that event. It wasn’t even so much that we hated each other or something; it was just more like, “Man, the thing we have in common is really not great, and I don’t know if I want to revisit that.” Maybe that wouldn’t have been right 5 years ago or 10 years ago, but in the fullness of time, it was.

What I’m saying is that there’s always hope and there’s always hardship. Hope is not a panacea that says things aren’t going to be hard and you’re not going to suffer or other people aren’t going to suffer. You will. I mean, you just will. That suffering takes many different forms. But there are definitely things to learn in the midst of that. There are growth opportunities in the midst of that.

I think that even parlays into our journey together at Adam Networks. If we were writing the story, we have this powerful technology and we have this great team—well, this should have been immediately adopted by everybody five years ago. It’s like, that’s not the story. The story is much harder, to kind of walk that path, but that’s actually good. Because the point isn’t X number of dollars in ARR. The point isn’t an exit at some valuation multiple. The point is to actually grow as humans, to have our character be developed and to serve others.

All of the efficiencies that we are growing in and continuing to establish and all of the growth that we are experiencing is great, but that’s actually a byproduct. That’s not the point. The point is the relationships within our team and the point is the relationships with the people that we get to serve. If that’s what we’re focused on, and we work with good people that we trust, then a lot of these other problems—i.e., authoritarian leadership that makes dumb decisions that you have to try and work with—become a lot less likely if you’re actually listening to your team because you have a relational baseline that’s positive. Then you’re a lot less likely to find yourself in that scenario where bad things happen because we didn’t listen.

That can still be true, but all of that has definitely… it’s not a journey that I would choose if I could. Even if I say all this today, I sound maybe more enlightened than I am on a podcast episode. I still struggle with it. There are still times where I think back at either that incident or just other things in my life—of people who have hurt me or things that I’m not proud of—and there’s still a temptation and opportunity to pick those things up again. We just don’t have to do that. But that also doesn’t mean that to forgive, to learn, to move on… it doesn’t mean that you don’t have to make amends sometimes because that’s part of the process too: acknowledging the truth. If you were part, even unwittingly, of harming someone else, you’ve got to own that. That’s part of that person’s healing and it’s part of yours, right?

There have been a lot more learning opportunities than I’ve necessarily volunteered for. But that’s also kind of the way it goes, I think, in life, too. When you sign up for something big—however you define that: you start a business, you get married, you have kids, you join the military—you’re never going to know what you’re signing up for. I mean, think about it: be deliberate, do all the things that you can to understand the choice that you’re making, but at the end of the day, you really don’t know how it’s going to go until you’re in the middle of it.

That’s why that forgiveness and resilience piece is so important because that’s going to enable you to function in the midst of a world that is pretty messed up a lot of times and doesn’t work the way we want it to work. Increasingly, I view that as a feature, not a bug. That’s just… I don’t get [upset]. If I walk into a situation that’s dysfunctional, 15 or 20 years ago I would have spent a certain amount of time thinking, “Can you believe it? Can you believe how this is operating? Can you believe that?” Now I’m just shocked when something works, just because I understand how hard it is to make stuff work. I understand how fragile we are as human beings. So there’s a lot more compassion, a lot more patience. I have the scar tissue from my own impatience where I’ve been like, “This has to work and this has to do that.” It’s just like, look, let’s just take a breath. It’s okay. So that’s been part of my journey certainly and kind of how the military has intersected with that.

David Redekop: Wow. No wonder you’ve brought so many defensive thought patterns to the company, and we’re grateful for that. But one of the things that makes things very, very real for me is when real human lives are at stake. That is why your story is so touching. One of those casualties was Pat Tillman. Not that Pat has any more human value than someone who wasn’t a public personality, but that must have brought on a whole new level of pressure that wouldn’t have been the case if he was an unknown personality. But Pat was known, not just in the US as a football hero, but in Canada and the rest of the world that watches football. Would it have been significantly different if the casualties had not been a public personality at all?

Steven Elliott: You wouldn’t even know about it. I mean, I know other people within that same world who have come to me over the years—they came to me privately and told me of… again, it’s not common but it happens. They’ve told me of friendly fire incidents that as far as anybody knows, aren’t. Because it takes a lot for an organization to admit a mistake, and especially an organization like the Ranger Regiment—insert whatever unit that kind of has a persona to protect. We’re supposed to be superhuman, but we all make mistakes.

Again, that’s a fragile mindset because that’s your mindset as a human, as a CEO, as a CFO, as a whatever. It’s like, “All right, I’m prepared and I’m going to just nail it and I’m going to be perfect.” You are going to be sorely disappointed and you’re going to be very fragile. You’re not going to know how to deal with failure that will inevitably come and disappointment that will inevitably come.

Yeah, I mean, we didn’t know. I knew Pat played in the NFL. I wasn’t close with him. I saw him most days because his brother and I were in the same squad, so I worked very closely with Pat’s brother, Kevin. Both of them were just great guys in the formation. They did their job, kept their mouth shut, treated everyone with respect, and everyone in the platoon, including the leadership, loved working with them. They didn’t bring an ounce of any sort of prima donna mindset to their work.

I just knew him as him, a guy that I worked with. It wasn’t until I got back from Afghanistan that one of the guys in our platoon, who hadn’t deployed (I think he was at another school), had gotten us all copies of Sports Illustrated and Pat was on the cover. That was the first moment when I saw it. It was just like, “Ah, okay.”

It was a weird time too because it was an in-between time in the war but also an in-between time in terms of the internet. We didn’t have social media; we didn’t have the modalities of communication that we have today. You had the internet, so news was traveling, but it was still pretty analog. So his [identity]—who he was prior to the Army—definitely created a firestorm of attention around the incident.

That’s the other kind of lesson from a leadership standpoint. We gave statements; there was no question that it was friendly fire. Our platoon sergeant walked the battalion commander through the site the following day and said, “Sir, it was friendly fire.” That was made abundantly clear, but then other leaders higher up the food chain made the decision to spin a different narrative that they thought would be more palatable to the unit, to themselves potentially.

That made it an even bigger thing than it would have been. Now you have this idea of a military cover-up where the country is told on ESPN at a memorial service that he was killed by enemy fire, which I didn’t watch (I was in country). But once that lie unravels, all sorts of other speculations and questions get thrown into the mix.

That’s the other leadership lesson: bad news does not get better with age. The more sensitive and the more negative a situation is, the more imperative it is that you are truthful, imperative it is that you are transparent. If there is something about the situation that you honestly don’t know, “I don’t know” is an acceptable answer. That was not handled well by a number of senior leaders within the Army and the Pentagon, and the people who paid the price for that were Pat’s family primarily, and us to a lesser degree.

It’s also just a function, I think, of a society looking for something to look up to. Then it also becomes kind of a rumination on fame, on celebrity. I think today Pat is a symbol, which… I’m not necessarily opposed to that. It’s just the danger of turning a human into a symbol is that you get to project upon that symbol whatever you want. Pick a political issue: you have his name invoked on one side of the issue (“if he was here, he would do and say this”) and then you have his name invoked on another side of the issue (“if he was here, he would do and say this”). At the end of the day, we don’t know because he’s not here. But that’s tempting in a world where people are looking for meaning; they’re looking for something to hold on to. So yeah, it definitely made it a much more challenging, much more public sort of thing to walk through, for sure.

David Redekop: I can’t even imagine, Steven. I have so many thoughts and so many lessons out of that. People can draw their own conclusions and I know we’re going to be benefiting from your experience for years to come. Thank you for writing a book on this. I will include it in the show notes: War Story. Our son Silas is a very proud owner of a signed copy, as am I. He was very excited to meet you. Thank you for what you’ve done, serving in the best way that you knew how to. That’s really a heritage that you and I have in common with our parents and grandparents and the ones that went before them: that they really served the best way that they knew how. That intent and that value system was successfully transferred to you. For that, we are all benefactors.

Those of you that are hearing or watching this and are seeing some of the characteristics that Steven has just shared in our organization now, you have an idea where they come from. We know that we can make mistakes and we have all made plenty of them. But being truthful about them has been at the core of Steven’s voice anytime. When you’re in cyber and you do make mistakes, or you make a claim that was true at the time you made it but then later on becomes questionable, that is something that you have to address.

We’re right in the middle of one of those right now. Over the next 90 days, there’s some really interesting things that are happening in cyber. So your voice will be very important in this as well, Steven. I’m not trying to be mysterious about anything, but it has to do with how internet traffic is being disguised as something other than what it is in a way that many big tech organizations can’t do anything about. It has to do with ad fraud. Oh my goodness, the story is so complex, but we’re going to unravel it together. We’re going to be truthful about it 100% and present it from every angle. We actually delayed our recording because we’re right in the middle of the weeds for that. Steven, I really appreciate your time today. Is there any remaining piece of wisdom that you would really like our team or audience to hear from you?

Steven Elliott: I don’t know. I think one thing I’ve been thinking about… AI is kind of dominating the conversation in all facets of life. Long and short of it is, we know that it’s important. We know it’s going to transform things, but we don’t know how. We’re not going to know how anymore than we knew how the internet was going to transform things in the year 2000. We knew it was big, we knew it was important, but how that was going to work itself out kind of remained to be seen.

It’s more of an encouragement; I’m probably just talking to myself as much as I am anybody else. It’s just an issue to not be afraid. It’s an invitation to focus on the work that each of us has been given to do—to be aware, to watch and learn and observe. But there are a lot of voices that are telling us, and even organizations that are basically creating metrics on AI usage within their executive and leadership teams: “if you’re not using AI to whatever degree, then you can’t get promoted.” I think that’s stupid; I’ll just say that.

But it comes from a good place that says, “This is a powerful tool. We want you to use it.” I think the challenge for any of us in leadership, particularly in business, particularly in cyber, is to fight for that tactical pause—that moment where I’m getting a lot of information, getting a lot of conflicting things that are telling me “this is going to change everything” or “you don’t have to worry about it” or “if you’re not using it this way, this business is going to die.” All those voices are not helpful.

I think that’s part of our challenge—certainly my challenge in this age: to find a place where I’m aware of what’s going on. I’m not burying my head in the sand. There are ways that AI can improve and amplify my work. By all means, let’s use it. But I think we just have to operate from a place of curiosity and not from a place of fear, because that’s not going to lead… even if you make the right decision from a place of fear, which is unlikely, it’s probably not going to lead to a good outcome. I think that’ll be a perpetual challenge for some time to come because we’re now in the age of AI.

David Redekop: Don’t be in a hurry to die.

Steven Elliott: That’s right.

David Redekop: Because it just might happen if you are too afraid. Oh my goodness, that is so ringing true for me. Thank you for your time today, Steven. Looking forward to our mission work together that we keep on executing on. So, thank you for today.

Steven Elliott: Thank you, David. Yeah, love it. It’s always good to see you.

David Redekop: Likewise. Bye for now.

Steven Elliott: Bye-bye.

David Redekop: The Defender’s Log requires more than a conversation. It takes action, research, and collective wisdom. If today’s episode resonated with you, we’d love to hear your insights. Join the conversation and help us shape the future together. We’ll be back with more stories, strategies, and real-world solutions that are making a difference for everyone. In the meantime, be sure to subscribe, rate, write a review, and share it with someone you think would benefit from it too. Thanks for listening, and we’ll see you on the next episode.

1 post - 1 participant

Read full topic

The post TDL | Defense Before Offense: Leadership, Risk, and the Cost of Bad Decisions | Steven Elliott appeared first on Security Boulevard.

Author, Creator & Presenter: Jannis Kirschner, Niantic Inc.

Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) content on the Organizations' YouTube Channel.

Permalink

The post USENIX Security ’25 (Enigma Track) – Please (Don’t) Stop The Music: Adversarial Red-Teaming Of AI Music Generation Models appeared first on Security Boulevard.