“Attention: Any employee who completed the retina scan between 8:00 and 10:00am this morning should contact their eye-care provider immediately.
Employees who are unable to read this announcement should contact HR.
Thank you.”
—why I’ll only spit in a cup for a bio-password-thing
Vendor: “Our SOC2 provides assurance …”
Me: “That’s great. But I asked for a summary remediation report of the relevant Critical and High vulnerabilities.”
Sniper Barbie retweeted
Maybe we need to start teaching InfoSec history.
Here are the things we did and why. We tried some stuff that didn’t work.
In the end it comes down to human error almost always. Didnt upgrade. Misconfiguration. Gave away creds. So we protect our users from themselves.
And there is “AI” working and ppl not questioning the results.
Replying to @EscobedoIA72
El historial de versiones del documento. 214 revisiones. Cuatro horas y media de escritura repartidas en tres días, con sus borrados, sus frases a medias y sus pausas.
El profesor lo miró y me dijo que el sistema de detección es muy fiable.
Le pregunté qué margen de error tiene. No lo sabía.
Le pregunté quién había validado ese 97 %. Tampoco.
No denuncié a nadie. Presenté la revisión de la calificación por escrito y adjunté el historial.
Se la corrigieron a la semana siguiente.
Lo que me preocupa no es el cero. Es que a mi hija le dijeron delante de la clase que había hecho trampas, y la prueba de que no era así la tenía yo en una pestaña del navegador.
Están usando una máquina para acusar a adolescentes sin saber cómo funciona la máquina.
Advice to legal:
Not every sentence needs improvement simply because Track Changes is turned on.
—there isn’t any credit given by how many edits made to the terms !!
Vendor contract dealing:
Me: “What control were you trying to solve with this edit?”
Vendor legal: “There wasn’t one.”
Me: “Great. Delete it.”
Vendor legal: “Well, let’s not make any rash decisions.”
—and they just did, repeatedly
Vendor contract legal … there comes a time when it appears legal is paid by the letters edited in a contract !!
Not the words but by the letters. Dear gawd, it gets annoying.
Vendor argues:
Vendor: “AWS performs the physical security controls.”
Me: “Fine”
Vendor: “AWS is independently audited.”
Me: “Also fine.”
Vendor: “Therefore we’re no longer accountable for physical security.”
Me: “Now we are not fine.”
*sighs*
As you can see by my recent postings about vendor contract terms, either I get a headache or I can laugh … I prefer laughing. And some of them are sooo good.
Vendor: “Our SOC2 demonstrates compliance.”
Me: “Excellent. Which control actually ?”
Vendor: “ … “
Me: “Take your time. I have the report open.”
Would you accept this edit in Access Management / controls? “Utilize single use credentials, >>where applicable<<“ was added ??
—hint, it is a loaded question !
Vendor: “Our cloud provider handles that.”
Me: “Wonderful. Make sure that your contract with them requires it.”
Vendor: “But they’re responsible for it.”
Me: “I heard you the first time. And you’re responsible to us.”
—fyi, I don’t have an agreement with your cloud provider, you do !!
Real quick … for those of you that know what a SOC2 is, please advise your legal counsel that is NOT a security standard.
A SOC2 doesn’t not prescribe security standards, it’s a measurement of how compliant you with your own standards, and hopefully you made those based upon recognized standards, such as NIST, or ISO.
*sighs*
Vendor contract pushback …
Vendor: “We do not provide client-specific security documentation.”
Me: “Fine. I’ll take the client-facing security documentation you already provide in the link you sent earlier.”
Vendor: “ … “
Me: “Glad we cleared that up.”
Sniper Barbie retweeted
Microsoft Says AI Agents Cannot Be Trusted and Could Become Insider Security Threats
Details: cybersecuritynews.com/ai-mod…
Microsoft warns organizations to treat AI agents as potential insider risks not because they are automatically malicious, but because they can access company data, apps, and tools and act on that access at high speed.
The warning, published on October 19, 2026, comes as businesses use agents to handle tasks such as writing code, reviewing documents, and processing expenses.
An agent’s actions can change as its instructions, data, or working context change. It may make a mistake, follow harmful directions hidden in a document, or be compromised.
#cybersecuritynews
Security: “Yes, that’s absolutely our process.”
Legal: “We cannot contractually commit to that.”
Judy: “Have you two met yet in your enterprise?”








