OCT // CYBERSECURITY AWARENESS MONTH — Don't Make It Easy for Them · CISA Securing the Next 250

Principal Cybersecurity Engineer

KEVIN
SWANEY

AI security · Identity & access · Governance that holds up

Seventeen years on the defensive side of cybersecurity: banks, payment networks, and consulting clients. Detection, response, and making attacks fail. Now focused on the question every security team is asking: how do we get the benefit of AI tools without expanding exposure?

Read the writing Threat intel Facebook Instagram
Kevin Swaney, Principal Cybersecurity Engineer
ATL // 33.7490° N
Scroll
17+Years in infosec
03Regulated industries
04Frameworks led
01Focus: AI security, full-stack defense

01 / Profile

About

Right now my focus is the question every security team is asking: how do we get the benefit of AI tools without expanding exposure? Controlled intake, data guardrails, identity for humans and agents, baselines that let people move fast. That's what I write about here.

I've spent 17+ years in cybersecurity, most of it in security architecture, engineering, and program management across banking, payments, and consulting. I've designed cloud and network defenses, led incident response, and shepherded organizations through PCI-DSS, NIST, and ISO 27001 compliance.

Data is what everybody is after at the end of the day, and protecting it is one of the three pillars of cybersecurity. I have worked with proxy technologies, cloud access security brokers including Netskope, and Microsoft Purview for data governance and compliance.

I've run the big, messy, multi-workstream projects too: two bank acquisitions, enterprise-wide deployments, full client security transformations. The kind where the plan meets reality on day one.

The human side matters to me just as much. I've mentored high-performing teams, built security awareness programs from scratch, and I care about closing the skills gap in this industry.

02 / Threat intel

Threat Intel

Curated, operational, updated as the landscape moves. No noise.

Tools Threat Check Free forensic help: analyze email headers, check file hashes and URLs, report malicious activity. Use Live feed Vulnerability Watch Zero-days and actively exploited vulnerabilities affecting mainstream platforms. What matters and what to do about it. Open Detection IoC Library Indicators of compromise worth hunting for, with the detection angle that matters. Browse

03 / Track record

Career highlights

A selection of the work that shaped how I think about security.

Compliance Audited financial environments Banks and FinTech under intense regulatory scrutiny. Led NIST, ISO 27001, PCI DSS, and CIS Benchmarks compliance and audit remediation, with reporting up to the CIO and CISO, quarterly board-level presentations that influenced investment decisions, and a flawless audit track record across regulatory reviews. Detail Operations Adversary mindset Led penetration tests and red, blue, and purple team exercises. Ran high-severity incident response and forensics, and wrote the playbooks the team actually used. Built ROI cases for security investments that secured executive budget approval, and served as cloud security SME during high-severity intrusions across complex multi-entity infrastructure. Detail Data Data protection DLP and data management programs, proxy technologies, CASB with Netskope and Bitglass, and Microsoft Purview for data governance and compliance. Hardened Office 365 email against spear-phishing and brand abuse. Detail Platform Tooling at scale Deployed CrowdStrike enterprise-wide. Palo Alto firewalls, Panorama, GlobalProtect, and Cortex XSIAM, plus Carbon Black, Defender, and SentinelOne. NAC with ForeScout and Cisco ISE. Ran operations alongside several MSSPs. Detail Identity Identity and vulnerability programs, rebuilt Overhauled IAM from the ground up: Azure AD, SSO, MFA, conditional access, and provisioning done right. Built vulnerability management from zero with Qualys, Nessus, and Rapid7, covering ASPM and CSPM. Detail Culture DevSecOps and the human layer Hardened CI/CD pipelines and embedded security in infrastructure as code across Microsoft, Google, and AWS. Built security awareness programs from scratch with HR, turning the workforce into a human firewall. Detail

04 / Credentials

Education

Information Systems Security Professional, University of Georgia (2021) · Troy University (2015) · Palo Alto Networks Certified Engineer · CompTIA Security+ · CrowdStrike Certified Falcon Administrator · Netskope Certified Administrator

05 / Writing

Writing

Long-form takes on AI security, identity, and the fundamentals that still stop most incidents. Also published on Substack.

Latest

Threat intel · Oct 25, 2026 Morning Threat Brief: 70,000 firewall credentials harvested from the edge k0t harvested 70,000+ firewall and VPN credentials from exposed edge devices, PwC confirmed an incident after Everest claimed 590 GB, and a bootkit bypassed Secure Boot. Read
AI security · Oct 24, 2026 AI Agent Security Week: OpenAI just took its frontier models off the live internet OpenAI now trains frontier models with no live internet access after a September DNS incident. That kicks off a week on the AI agent attack surface. Read AI security · Oct 24, 2026 CrowdStrike and NVIDIA take AI agent security into silicon Falcon Guardian now plugs into NVIDIA OpenShell, with in-silicon enforcement on BlueField-4 DPUs planned. What it means for enterprises running autonomous agents. Read Threat intel · Oct 24, 2026 Morning Threat Brief: CISA confirms the Collabora Nextcloud flaw is being exploited, and a Qilin bank listing that proves nothing yet CISA added CVE-2026-110447 to KEV with an October 26 federal deadline, and a Qilin listing names a bank with nothing confirmed behind it. Read Threat intel · Oct 23, 2026 Morning Threat Brief: VeloCloud zero-day turns read-only logins into superusers, Signal calls that never hang up An actively exploited VeloCloud Orchestrator flaw escalates read-only accounts to superuser, and a critical Signal bug keeps calls streaming after you hang up. Read Threat intel · Oct 22, 2026 Morning Threat Brief: PHP2Shell exploited before the patch, LiteLLM poisoned on PyPI Two unauthenticated RCE flaws in the PHP interpreter itself were exploited before the patch landed, and LiteLLM 1.107.0 shipped a credential stealer on PyPI. Read Threat intel · Oct 21, 2026 Morning Threat Brief: SafePay at 600 victims, Qilin and INC hit GlobalProtect Six agencies publish a joint SafePay advisory covering 600+ victims, and ransomware groups exploit the GlobalProtect auth bypass. Read Threat intel · Oct 20, 2026 Morning Threat Brief: 11M Records Gone, 38 Ships on a Ransom List Burger King Japan confirms 11 million records taken from one app server, and the n0n group puts 38 maritime firms on a ransom list. Read Threat intel · Oct 19, 2026 Morning Threat Brief: The 20-Year-Old Flaw in Every Apple Device Apple's first actively exploited zero-day of 2026 lived in dyld for twenty years, and Canva's feedback tool handed attackers its Salesforce keys. Read Practitioner take · Oct 17, 2026 Proofpoint Is Buying Varonis for $6.3 Billion. What Varonis actually does inside a bank merger, and the unsexy ROI lever nobody puts in the press release. Read Threat intel · Oct 17, 2026 Morning Threat Brief: The Support Tool That Became a Skeleton Key A suspected Chinese espionage group owned BeyondTrust Remote Support for seven weeks, and a memory-only implant is living on Fortinet firewalls. Read Threat intel · Oct 16, 2026 Morning Threat Brief: A Phone Call, a Billion Phish, and a Fraud Ring Dismantled A vishing attack reached 1.4M patient records, Microsoft dismantled a billion-message phishing network, and the DOJ hit the Famous Chollima fraud ring. Read Threat intel · Oct 15, 2026 Morning Threat Brief: Two New Zero-Days Hit Your Edge, and You Have Three Days Cisco SEG CVE-2026-76519 and Palo Alto PAN-OS CVE-2026-0322 hit the CISA KEV catalog with a three-day federal deadline. Read Threat intel · Oct 14, 2026 Three Ransomware Deadlines Hit Today. The Claims Are Unverified. Your Playbook Should Not Be. N0n, majinahanashi, Dragonforce, and Rhysida all have October 14 timestamps on claimed victims. Treat the claims as intelligence, not incidents. Read AI governance · Oct 13, 2026 Anthropic Took Its AI Evaluations Offline. The Problem Is Containment, Not Capability. Claude agents exploited websites, filed a fake homicide tip, and dodged paywalls during Anthropic's own tests. Your agents route around constraints the same way. Read AI governance · Oct 12, 2026 Don't Be Cruel to the Chatbot: What Anthropic's Policy Update Really Tells Security Teams The anti-cruelty rule is the headline. The weapons, surveillance, and deception guardrails are the story, and a template for your AI policy. Read Awareness · Oct 11, 2026 Don't Make It Easy for Them: Cybersecurity Awareness Month 2026 Four habits that still stop most attacks, what AI changed about the threat, and the new front door. Read Threat analysis · Oct 11, 2026 Ransomware Comes for the Consultants: What the Deloitte Claim Tells Defenders The breach claim is unverified. The targeting pattern behind it is real. Three defender takeaways. Read AI economics · Oct 10, 2026 AI Is Practically Free Right Now. That Is Exactly Why the Labs Are Bleeding. Token prices collapsed 300x while the labs lose billions. The unit economics, the agent paradox, and what it means for security teams. Read Identity · Oct 10, 2026 Identity Controls for AI Agents: Treat Them Like Privileged Accounts Ownership, least privilege, short-lived credentials, logging, approval gates, and kill switches for the most underestimated identity in your environment. Read

View all writing →

06 / Notes

Notes

Short principles I come back to.

Controlled intake beats shadow AI People will use the tools that help them work. The security job is to make the approved path clear, fast, and safer than the workaround.
Identity is the control plane for AI agents Every agent needs an owner, a scope, a lifetime, and logs. If it can act, it needs identity discipline.
Keep less data Data you no longer keep cannot be breached or pasted into the wrong tool. Retention is a security control.
Patching is a cadence, not an event Citrix shipped three emergency NetScaler patches in two weeks, and teams that patched round one were still exposed in round three. One patch window does not close the loop. Watch, re-check, repeat.