Interested in Next-Gen Cyber AI? With an ever evolving world, the only option for the ambitious secpro is to stay ahead of the game. Check out our upcoming conference with big names like Mark Simos, Nikhil Kumar, and Katie Paxton-Fear, who have a lot to say about the way they are overcoming new problems with AI and supporting others following their paths!

Welcome to another_secpro!

This week, we're finishing off our focus on the final piece of the Cyber Key Chain: "actions on objectives". Next week, we're rolling out a recap of the CKC and taking a vote on what we do next - because we're nothing if not democratic!

Also, check out our news and academic reviews sections to stretch your skills and check your mental chops!

If you want more, you know what you need to do: sign up to the premium and get access to everything we have on offer. Click the link above to visit our Substack and sign up there!

Cheers!
Austin Miller
Editor-in-Chief

When we talk about “actions on objectives” in cybersecurity, we’re talking about the part of an attack where the intruder finally tries to get what they came for. It’s the payoff stage. They’ve already found a way in, moved through the network, and positioned themselves to strike. At this point, the attacker shifts from preparation to execution. This is where the real damage happens: data gets stolen, systems get destroyed, or resources get used for the attacker’s purposes.

If you're looking forward to our upcoming conference or just want a little insight into who these industry-leading speakers are, here's a little bio on two of our closest collaborators: Mark Simos and Nikhil Kumar.

Mark Simos is Lead Cybersecurity Architect for Microsoft where he leads the development of cybersecurity reference architectures, best practices, reference strategies, prescriptive roadmaps, CISO workshops, and other guidance to secure organizations in the digital age.

Mark helps organizations meet cybersecurity and digital transformation goals by combining learnings from across Microsoft customers with Microsoft’s experience operating and protecting hyper-scale cloud services.

Mark is co-author of the Zero Trust Playbook (http://zerotrustplaybook.com) and co-host of the Azure Security Podcast. Mark actively contributes to open standards and publications including the Zero Trust Reference Model, Zero Trust Commandments, Security Principles for Architecture, NIST Guide for Cybersecurity Event Recovery (800-184), NIST Guide to Enterprise Patch Management (800-40), Microsoft Digital Defense Report, and Microsoft Security blogs.

Mark also chairs the Security Forum and co-chairs the Zero Trust Architecture (ZTA) working group at The Open Group and has presented numerous conferences including Black Hat USA, RSA Conference, Gartner Security & Risk Management, BSides, Microsoft BlueHat, Microsoft Ignite, and Financial Executives International.

Nikhil is an industry expert and thought leader in Digital Transformation, Zero Trust and InfoSec, AI, Cloud Computing, APIs and SOA, with a passion for applying technology in an actionable manner. An entrepreneur with over 20 years experience, he is known as a servant leader able to create amazing solutions and bridge people, process, business and technology.

With a life-long passion for actionable delivery and Computer Architecture, and over 40 publications and presentations at blind-refereed fora, Nikhil has delivered Enterprise, AI, Cloud, Security, SOA, Information, Enterprise and Application Architecture solutions for Fortune 10 organizations to startups. A successful MIT Startup mentor, he has taken companies to market, run legacy modernization initiatives, and led small to large teams. Clients include AMEX, bonddeskgroup, Comerica Bank, The Hartford, Sovereign Bank, St. John Health Systems, AFLAC, GMAC, etc.. Known as a trusted partner and change leader, Nikhil often acts in CXO advisory and leadership roles.

As a thought leader Nikhil has been invited to and led and authored numerous global industry standards, such as co-chairing the Zero Trust Working Group, SOA Reference Architecture and SOA for Business Technology Guide, and is actively involved in Precision Medicine, Digital Transformation, Zero Trust and APIs/ SOA. Nikhil started ApTSi to create the solutions company of the future based on innovation and application with a belief that actionable solutions combine people, process, technology, frameworks and products, to provide high quality, risk managed, agile solutions.

Accenture’s Largest-Ever Cybersecurity Acquisition: CyberCX Deal: Accenture has agreed to acquire CyberCX, an Australian cybersecurity firm founded in 2019 with 1,400 employees and a presence in Australia, New Zealand, London, and New York. The purchase, reported to be over A$1 billion (~US$650 million), marks Accenture’s biggest move in the cybersecurity space to date and follows its pattern of expanding services to meet escalating AI-related threats.

Shift to Offensive Security as Proactive Defense: In response to rising automation and AI-driven cyber threats—highlighted by recent UK retail breaches—this article advocates for offensive security. Techniques like red teaming and penetration testing are recommended to identify and mitigate vulnerabilities before they’re exploited, shifting from reactive to evidence-based defense.

UK’s Chronic Cyber Skills Shortage Exposes SMEs to Risk: The UK is facing a serious shortage of cybersecurity professionals—particularly in SMEs—which jeopardizes national cyber resilience. A report by De Montfort University for the All-Party Parliamentary Group on Cyber Innovation calls for a national skills taxonomy, standardized recruitment, and interdisciplinary training to bridge the gap.

Fragmented Cybersecurity Tools Undermine Organizational Defense: As businesses adopt an expanding mix of disconnected security tools to manage evolving infrastructure, they face visibility gaps, data silos, and inefficient risk response. The article urges the adoption of unified, AI-driven cybersecurity platforms to consolidate asset management, threat detection, and compliance for stronger defense.

Cybersecurity Must Be ‘Secure by Design’ Rather Than Reactive: Responding to rapidly evolving cyber threats, the UK Public Accounts Committee criticizes outdated “build and forget” security models. The piece calls for embedding cybersecurity across system lifecycles, regulatory reform (e.g., Cyber Security and Resilience Bill), continuous monitoring, and workforce development to shift toward a proactive posture.

Zero trust cybersecurity: Critical success factors and a maturity assessment framework (William Yeoh, Marina Liu, Malcolm Shore, Frank Jiang): Reports a three-round Delphi study with 12 security experts to identify the critical success factors for zero-trust programs. It organizes eight dimensions—identity, endpoint, application/workload, data, network, infrastructure, visibility & analytics, and automation & orchestration—and proposes a practical maturity assessment to benchmark adoption.

Verify and trust: A multidimensional survey of zero-trust security in the age of IoT (Muhammad Ajmal Azad, Sidrah Abdullah, Junaid Arshad, Harjinder Lallie, Yussuf Hassan Ahmed): A peer-reviewed survey that synthesizes zero-trust principles and technologies for IoT systems, covering authentication/authorization models, policy-based access, micro-segmentation, and the use of blockchain. It maps applications across sectors and highlights open research issues and deployment recommendations.

A Proposal for a Zero-Trust-Based Multi-Level Security Model and Its Security Controls(Jae-Won Park, Hye-Young Park, H. Youm): Proposes and implements a model that fuses Multi-Level Security (MLS) with zero-trust principles. The paper details policy enforcement and control mechanisms to continuously verify subjects and objects across classification levels, and discusses how the integrated approach mitigates lateral movement and insider threats.