Welcome to The GRC Guy!
GRCGuy.io is a cybersecurity and compliance blog providing insights on governance, risk management, HIPAA, SOC 2, ISO 27001, AI security, and emerging cyber threats.
Two critical remote code execution flaws in PHP itself, patched in an emergency release on October 21. Updating your CMS does nothing. Here is what is confirmed, what is disputed, and what a GRC program should do this week.
Read more →Every weakness in this incident was ordinary. That is the point. An autonomous AI agent ran an end-to-end intrusion against Hugging Face's production infrastructure, and nearly every control that failed is one you already have a policy for.
Read more →A TheGRCGuy recap of Black Hat USA and DEF CON 34: agentic AI is now a governance problem, the harness wars, ChainDrop, and the identity story underneath it all.
Read more →Release, jailbreak report, export controls, remediation, restoration, all in under a month. One of the most instructive case studies yet in how AI governance works, and doesn't, when the stakes get real.
Read more →For the first time, an AI vendor has publicly released a model while admitting its unrestricted version is too powerful for general availability. What the Fable and Mythos split means for cybersecurity leaders.
Read more →
About me
As a dedicated educator in the realm of cybersecurity, I am excited to share my extensive 13 years of experience and knowledge in this field.
This blog is thoughtfully designed for individuals with a keen interest in cybersecurity, those who are contemplating a career change, or those who are embarking on their professional journey in this domain. Within this site, you can expect to find a series of informative videos in which I delve into various aspects of cybersecurity, covering not only Governance, Risk Management, and Compliance (GRC) but also delving into a wide array of cybersecurity topics.
Feel free to connect with me at any juncture if you have questions or seek further information. Your engagement and inquiries are always welcomed. Thank you for being a part of this cybersecurity community!
Additionally, from time to time, I will be conducting interviews with esteemed peers in the field, providing further insights into the subjects I've covered. You can count on this blog to be a valuable resource, featuring a repository of exceptional cybersecurity-related materials that I've thoughtfully curated over time.
Invitations to conduct talks, interviews or if you have general inquiries, please fill out the form below.
