Dan Schoenbaum

I’ve spent nearly 30 years in Analyst Relations, and I’ve come to believe there’s one brutally simple test of whether an AR program is actually working: What changed because AR exists? Did Strategy learn something? Did Product rethink something? Did Sales gain ammunition it could actually use? Did the corporate narrative get sharper? Did an executive make a better decision? Because conducting more analyst briefings isn’t the goal. Business impact is. I wrote about three things I believe separate merely good AR from world-class AR — and how to turn analyst intelligence into something the business can actually use. And yes, somehow Frank Sinatra and Count Basie made it into the discussion.

What happens when you and your spouse don’t retire at the same time? I retired early from law. My husband still loves his work. That leaves us with different amounts of free time, different constraints—and sometimes different ideas about how to spend the years ahead. For a while, I treated that mismatch as a reason to wait. If he couldn’t take a trip, or didn’t want to, perhaps I shouldn’t go either. But waiting isn’t neutral. At this stage of life, it has a cost. I’ve learned that a good marriage doesn’t require identical retirement dates, interests or appetites for travel. It does require honest conversations about money, guilt, resentment, FOMO—and whether both people still feel considered. I travel with my husband. I also travel with my sister, my friends, my children and occasionally by myself. The choice wasn’t between my marriage and my freedom. It was learning to make room for both. This week, I wrote about finally going to India without my husband—and why loving someone doesn’t have to mean taking every trip together. https://lnkd.in/gfvhVrvn Have different retirement timelines affected how you and your partner spend your time?

Each year, two of the world's largest cybersecurity events happen back to back in Las Vegas. Black Hat is more corporate-facing, while DEF CON has a distinct hacker ethos, with about 30k participants across dozens of “villages.” I focus primarily on blockchain security which doesn’t have much presence at these conferences. However, the lines between traditional finance (TradFi) and decentralized finance (DeFi) are starting to blur, so I thought I’d spend some time at DEF CON this year. I noticed a huge chasm between the Web3 security world and the world of Web2 cybersecurity. To give some perspective, the two most common impacts of Critical and High severity vulnerabilities in the Web3 world are: 1. Loss of funds 2. Permanent freezing of capital These two impacts have resulted in billions of dollars of cryptocurrency being lost in the past year or so. Whereas in Web2 cybersecurity, the most common impacts are: 1. Broken access control leading to data theft 2. Remote code execution leading to data theft 3. Privilege escalation leading to data theft As you can see, one world is about stealing money. The other is about stealing data (and sometimes money indirectly through ransomware). That’s why a CISO is a Chief Information Security Officer. The job is securing data in Web2. In Web3, it’s securing money. Because of this, security standards in the Web2 cybersecurity world dictate very different response times. Over the weekend, multiple institutional teams noted that an ideal resolution time for vulnerabilities in production is between 5 to 15 days, and many High severity vulnerabilities go unfixed for weeks. These timelines are unheard of in Web3 security. In our field, if an issue is left in production for any period of time, hundreds of millions of dollars can be drained in a 12-second Ethereum block. Which is why so much time and effort is poured into prevention in the Web3 world. Another key difference between the Web2 and Web3 security worlds comes down to mutability. In TradFi, ledgers are centralized and even if a bad actor shifts funds into their own accounts, banks can simply claw back or reverse the transactions. For decentralized blockchains, the money-stealing transactions are near instantaneous and recoverability is substantially more difficult (and in many cases impossible). As institutions adopt blockchain technology, security teams must adapt to their new reality. In many cases, small Web3 teams have higher security standards than the biggest institutions in the world, especially when it comes to prevention and shifting left. Because they have to. What’s at stake in the Web3 world is more valuable and easier to steal. As institutions make greater forays into the blockchain world, CISOs and security leaders must lead the way by putting plans in place to increase the rigor of their internal and external security practices to prepare for this more adversarial environment. We are helping some of them already.

OH CRAP. An approval rule can look harmless in a list. Its Active flag can decide whether a business control runs at all. Which approval path would create the biggest problem if it silently stopped firing? #ServiceNow #WorkflowStudio

What does Brian Hackney really think about AI governance in security? Watch to hear his perspectives on whether AI favors attackers or defenders, where organizations are seeing real value, and what your security team should be doing right now... #ExposureManagement #AIforCyberSecurity #VulnerabilityPrioritization

Austin delivered this week! Offsites, time with the GTM team and lots of sunshine!

OH CRAP. Roles assigned through groups are inherited. One wrong removal can take access away from everyone who depends on that role. What is the most consequential role change you have seen—and how quickly did the platform team know? #ServiceNow #PlatformOwner