X
Back to blog

Cybersecurity Insights with Contrast CISO David Lindner | 05/30/25

By David Lindner, Chief Information Security Officer

May 30, 2025

Insight No. 1 — Prioritize proof over promises in agentic AI

SC World recently noted that there were three points missing from agentic AI conversations at RSAC. I agree. Many new technologies arrive with significant fanfare. Agentic AI is no exception. However, we must prioritize practical validation over promises. Without thorough proof of concepts (PoCs), our security operations cannot truly integrate these tools. Without clear ROI metrics, we cannot justify the investment. Our long-term security posture depends on this disciplined approach.

 

Insight No. 2 — Target remediation, not just patching every vulnerability

Stop the endless cycle of patching every vulnerability. NIST's new LEV equation offers a critical path to effective risk prioritization. A true risk picture emerges only when this is paired with deep application context and robust Application Detection and Response (ADR). It's time to shift to targeted remediation, driven by real exploitation likelihood and profound application insight.

 

Insight No. 3 — MFA and passwordless efforts are paying off

Discussions around AI-driven attack amplification are valid, yet Verizon Data Breach Incident Report (DBIR) data confirms a clear trend: Account compromise as a breach vector is decreasing. This decline directly reflects our strategic investment in robust multi-factor authentication (MFA) and passwordless initiatives. The path forward is unambiguous; continue fortifying these proven identity controls.
Security remediation DBIR ADR Exploitation agentic AI AgenticAI Passwordless Insights Validation Identity
David Lindner, Chief Information Security Officer

David Lindner, Chief Information Security Officer

David is an experienced application security professional with over 20 years in cybersecurity. In addition to serving as the chief information security officer, David leads the Contrast Labs team that is focused on analyzing threat intelligence to help enterprise clients develop more proactive approaches to their application security programs. Throughout his career, David has worked within multiple disciplines in the security field—from application development, to network architecture design and support, to IT security and consulting, to security training, to application security. Over the past decade, David has specialized in all things related to mobile applications and securing them. He has worked with many clients across industry sectors, including financial, government, automobile, healthcare, and retail. David is an active participant in numerous bug bounty programs.

Previous

Go Agent Dev Diary: Navigating os.Root and path-traversal vulnerabilities
Next

AI's speed paradox: Security is being left behind
Enlarged Image