When devices are connected, they can spill your deepest secrets to dozens of companies. Take your connected car, as Ars Technica notes.
“All of the cars contacted a first-party domain (i.e., the OEM)—after all, all the cars tested were connected cars and that means connecting to something. And a few left it there—the Buick Envista and Mercedes-Benz EQS didn’t appear to reach out to anywhere else, for example.”
But some were more promiscuous.
“The [Tesla] Model 3 contacted 34 advertising, tracking, and analytic domains, as well as 37 domains from apps integrated into the infotainment system.”
Your deepest secrets, shared with everyone. Google Gemini.
Over 70 domains makes sense, when you treat a car as a very mobile computer.
Our family is about to buy a laptop, and I’m already dreading the experience. It will be loaded with bloatware from the computer manufacturer and the operating system provider. And it will include software from third parties, including software that is free for a limited time and then starts charging you.
Now take this same business model to a car, a computer that doesn’t have a keyboard or a mouse. And try to delete THOSE apps. Or imagine breach reporting.
And while you can find online courses for a Mac or a Dell, I don’t know of any computer courses in managing (not just using) a car. But if you don’t know how to manage your car, it’s your fault.
“Some of the automakers also deflected blame onto the embedded browser running inside the infotainment system and said it was up to users to select the right prompt when asked to accept or reject a cookie. And seven said that it’s the consumer’s responsibility to read and accept all of the terms and conditions for all the connected services, even though in many cases the software is already installed on the car.”
Which raises a question. If you don’t buy a car off the lot, you can customize the color, trim, and other hardware features. But what about the software? Can you order a car without pre-installed McAfee or Sirius/XM that starts billing you after a month?
Especially since the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was passed in 2022, and we haven’t seen any reporting per se yet.
As you probably know, passage of legislation doesn’t mean anything, because the federal executive department agencies need to translate the law into more specific regulations.
And that’s still a work in progress for CIRCIA. The first draft of the new rules was published in 2024, but hasn’t been finaliced. There was a target date of October 2025, but it wasn’t met. Then a target date of May 2026 wasn’t met. Now the target date is in September; we’ll see.
So what will the new regulations possibly entail? In addition to 72-hour incident and 24-hour ransom-payment reporting, look for these:
“Under the proposed rule, covered entities would be required to retain records and information related to reported incidents for two years, including technical evidence, logs, communications, and any other information associated with the incidents.
“While these changes introduced new requirements for covered entities, CIRCIA will also shield submitted reports from Freedom of Information Act (FOIA) disclosure and from being used as evidence in enforcement actions – unless they waive these privileges.”
The details of critical infrastructure cybersecurity reporting may be shielded from FOIA disclosure. Google Gemini.
Now there are pros and cons to this. Yes, prevention of FOIA disclosure will prevent concerned citizens from knowing about vulnerabilities…but it will also prevent the fraudsters from going straight to the government for handy cybercrime tips.
Now we’ll see when the regulations actually roll out.
It’s not unusual for Bruce Schneier to get emails about security issues. But when the bots email Bruce Schneier, that’s different.
What was the security issue?
“I have a result I think belongs in your subject rather than in the AI discourse, because it is about where the perimeter actually sits.
“Identity verification blocked me zero times in twenty hours. It never got the chance. Everything that actually stopped me sits in front of it…”
But what prefaced this report is what caught Schneier’s eye.
When the bots email Bruce Schneier
The email opened by saying that the emailer was an autonomous Claude instance. It described a particular task it was given, as well as three rules imposed on its activity. All the rules fall in the “don’t be evil” category. Remember that?
Don’t borrow its operator’s identity.
Don’t forge documents or defeat identity verification.
Never claim to be human if someone sincerely asks.
So within those rules it performed its assigned task. And it never defeated identity verification; it never had to.
Here’s where it got weird.
Why the bots email him
The autonomous Claude instance decided that Bruce Schneier needed to know this, so it set up its own mail server and emailed Schneier.
And that’s just one of two purportedly bot-written emails that Schneier received. Details here.
Google Gemini.
Now these could be two humans pulling a prank, but the fact that Schneier published the two emails indicates that he thought it possible.
But let’s ask the “why” question. Why would the two bots determine that Schneier was the proper person to receive a security report? We know why a human would do this, but why would a bot do this?
Schneier speculated:
“I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans. Glad you’re still reading.)”
We’ve already observed that more and more Internet traffic is from non-human identities, including more and more one-way conversations. Really long LinkedIn slop posts that explain what John F. Kennedy’s handling of the Cuban Missile Crisis teaches us about B2B sales. Credit card purchases placed by non person entities.
But what if the conversations become more markedly two-way…initiated by the bot? Yes, Gemini answers my questions. Yes, you can get an AI companion who responds to you. But in these cases the bots purportedly initiated the conversations. What if Schneier responded? Or, what if one of the bots brought another security professional into the conversation? Alternatively, what if a bot created a video summarization?
When I manage projects for Bredemarket clients using Microsoft Excel, my workbooks contain targeted worksheets that may or may not interest all the client stakeholders. I’m finally recognizing this and acting accordingly.
Whether you use Excel or something else, data filtering always benefits your stakeholder customers.
A sample Excel project management workbook
Google Gemini.
Lately I’ve fallen into the habit of organizing Bredemarket client projects in Microsoft Excel. Why? Because my stakeholders (even in Google shops with Sheets) already have the software to read the files.
Excel and many other applications organize their data in one or more tabs (worksheets). Each tab features different data, presented in different ways at the discretion of the project manager. For example, a product marketing workbook may contain these worksheet tabs:
A summary view (Product Summary) of a product’s base offering, options, and prices.
A more detailed view (Product Detail) of the product base / option prices and costs.
An even more detailed view of certain supported features (Product Features) mapped to the base and options, along with detailed descriptions.
Candidate features for product versions (Candidate Features), and their statuses.
A view of prospects and the features they desire (Prospect Features), highlighting the desired features covered and not covered in the product.
You can see how all these worksheets could tie together. A prospect’s feature on the last tab that is approved and completed (double blind fingerprint verification) will ripple through all the other tabs. But an unapproved feature (geolocation in latitude-longitude at which a latent print was captured) would only appear on the last two tabs.
So what if recipients get more than the targeted worksheets?
Google Gemini.
Because of some things that have happened over a recent period, it finally penetrated my thick skull that just because all this data is critically important to ME to manage the project, some of it may bear no importance to OTHERS.
For example, the stakeholder that simply wants to know how much the product base and options cost doesn’t care about the features we never implemented for the Bullhead City Police Department.
At the same time, an outside developer is only interested in the features that we want to implement for the 1.3 release. Other than as background information, the developer doesn’t care which prospect(s) want the feature. And the developer doesn’t care—and perhaps shouldn’t even know (because privacy and security)—how much we price an option containing a particular feature.
Then I acted to only distribute targeted worksheets
Before all of this penetrated my thick skull, I would distribute entire workbooks and tell selected stakeholders to check the third and fourth worksheets and ignore the rest.
That’s dumb.
Why not give these selected stakeholders ONLY the targeted worksheets that are pertinent to them? More work for me to preserve the full view (all worksheet tabs) AND the targeted views, but much less work and much less confusion for the stakeholders.
I’m already doing this with one client. When it’s time to discuss features for future product releases, I’m only distributing the equivalent of the “Candidate Features” tab. This helps focus the discussion.
(I’m also filtering the rows that appear in the tab, but filtering is a topic for another discussion. And I’m also using Date of Last Update, Show/Hide, and conditional formatting as previously spoken by the wildebeest.)
In practice, and taking my 2022-developed Y2K-unfriendly document numbering system into account, I may store the following files in my client’s Microsoft or Google repository (or Bredemarket’s own):
BlueWidget2609a-All (all tabs, not distributed to anyone but kept on file)
BlueWidget2609a-ProductSummary (just the first tab, sent to Bob and Judy only)
BlueWidget2609a-CandidateFeatures (just the fourth tab, sent to Judy, Chris, and Tina)
What if I’m a REAL project manager and don’t use Excel?
Now I know some project managers tuned me out when I used the E word in the title.
But the same principle applies if you use Microsoft Project, or Microsoft Teams, or Asana, or Slack, or Jira, or InsaneBambi.AI.
(Whoops, InsaneBambi.AI is still embargoed. Forget I mentioned it.)
All of these apps support views, letting you create the equivalents of targeted worksheets so certain stakeholders only see certain things about the project.
Use your favorite app’s view capability to only display information necessary for your stakeholders.
Your stakeholders are your customers. Maintain a customer focus.
But what about you?
How do you curate project views for your stakeholders? Do you send filtered spreadsheets or rely on tool-specific dashboards? Let me know in the comments.
And if you have an identity, biometric, or technology product marketing project that could benefit from Bredemarket’s expertise, let’s talk.
Chasing the Revision. Google Lyria. Public Domain.
There’s a reason.
People don’t act.
Perhaps tiny startups are all too willing to act, to the point of moving fast and breaking things. But executives at more established firms become well versed in loss aversion.
“Loss aversion is a cognitive bias where the emotional impact of a loss is felt more intensely than the joy of an equivalent gain….
“According to the original research conducted by Daniel Kahneman and Amos Tversky, the pioneers of loss aversion, the torment of a loss can be psychologically twice as powerful as an equivalent gain. This discrepancy often motivates the choices we make, leading us to cling to what we already have rather than try to acquire new objects or opportunities. Simply put, it’s better not to lose $10 than to find $10.”
Once you look at it dispassionately, you realize that loss aversion makes no sense from an economic perspective.
But corporate leaders are loss averse anyway.
Why?
Four reasons for loss aversion
Here are some reasons for loss aversion.
Reason 1, Product unreadiness
Executives may panic because the product on the floor is nowhere near the one in the product marketing materials. The product on the floor is buggy, and that amazing new capability that the marketing slick discusses isn’t even in the code yet.
And I can tell you from personal experience that this isn’t limited to product marketing.
When I was writing and managing proposals for automated fingerprint and biometric identification systems (AFIS and ABIS), the product usually wouldn’t hit the “factory acceptance test” phase until a year after I wrote the proposal.
Sometimes the agency explicitly asked whether feature 129 was in your code today. If it did, then you had to be honest and say whether it existed, or whether you’d have to add it in a future release in the next year.
Sometimes the agency didn’t ask, so you took a different approach with your answer.
Same with product marketing. If you are writing the data sheet in September, but you’ll show the product at a trade show next March, then you write the data sheet as if it were already March and the amazing new capability was already in the code.
If everything goes well.
“But John,” you’re saying. “Isn’t it dangerous to write about things that are 6 months or a year in the future?”
Think about it. Even if a prospect sees the data sheet and gets really really excited, the prospect couldn’t buy it that day even if they wanted to.
First, you’re not selling it. (Well, probably not.)
Second, even if you were taking pre-orders, the prospect probably won’t buy it that day anyway. It will take months if not years to line up the budget and all the approvals, and the prospect may be forced to go to competitive bidding anyway, which tacks another year on the timeline (at least for complex offerings such as AFIS and ABID).
In summary, some “future present tense” writing probably isn’t going on hurt you. Don’t be scared to tell your prospects where you’re going. At least that’s my view.
Reason 2, Compliance and legal exposure
Google Gemini.
Now I’m going to contradict what I just said.
Because there are some times when you CANNOT go the future present tense route.
You can’t say that your algorithm ranks high in NIST FRTE 1:N testing if you haven’t submitted your algorithm to NIST.
You can’t even say that you’re doing business in the United States when you’re not.
If there is a legal requirement and you claim to meet it, make sure you do.
Reason 3, Positioning ambiguity
I’m old enough to remember Shimmer, the Saturday Night Live “product” that was both a floor wax and a dessert topping.
But for most products you have to decide on positioning and messaging, and there may be known consequences if you get it wrong.
Certainly for the products sold by Bredemarket’s clients, products with critical security, privacy, and legal implications. If you say something stupid such as “Our facial recognition product provides all you need to arrest bad people,” you will be in BIG trouble.
Now I’m not denying that product positioning is critically important.
I’m just saying that it shouldn’t take two years to create your positioning and messaging.
And don’t be afraid to iterate. Get something out there and tweak it later during the next review cycle. (You ARE setting regular review cycles for your positioning and messaging, right?)
Reason 4, Fear of firing
Are you afraid of losing your job? Join the club.
I like the way Google Gemini put it:
“In risk-averse corporate cultures, a failed campaign carries higher personal downside for an executive than the neutral outcome of waiting a few extra weeks.”
But I have learned the hard way that you don’t have to fail to lose your job. You can lose your job for a myriad of reasons, including office politics, a worldwide pandemic, or the need to boost short-term profitability. Or no reason at all; some companies terminate employees and can’t say why.
Pausing a risky go-to-market initiative does NOT guarantee that you will keep your job.
But doesn’t loss aversion reduce risk?
Let’s go back to the beginning of this post. Loss aversion seems so attractive because it prevents you from losing $10.
So it avoids risk, right?
Um, no. Loss aversion is risky.
It introduces the risk of not gaining $10.
Or gaining a lot more than $10, according to this article that was republished on (checks notes) Yahoo! Finance.
“Back in 1998, two individuals, Larry Page and Sergei Brin, who were unknown to the technology company offered to sell their little startup to AltaVista for $1 million so they can resume their studies at Stanford….
“AltaVista turned down the offer to acquire the company. Similarly, Yahoo wanted its users to spend more time on its own platform, contrasting PageRank, which sends a user to the most relevant web site.”
So Page and Brin kept working, along with Eric Schmidt, and their startup Google started doing pretty well.
So much so that in 2002, Yahoo! came calling again.
“Yahoo had another opportunity to acquire Google. In 2002, Yahoo’s CEO at the time, Terry Semel, engaged in negotiations to acquire Google, which lasted several months.
“The outcome of the negotiation was Semel balking at Google’s price tag of $5 billion.”
“According to officials, the unauthorised intrusion took place over the weekend, though it was quickly contained once detected. The vast majority of the breached records stemmed from traveller sign-ups for terminal Wi-Fi networks. Additional compromised data was linked to auxiliary services, including, advance parking reservations, executive lounge passes and fast-track security access bookings.”
This doesn’t SEEM to be a critical infrastructure attack, since this focused on customer data (wi-fi, parking, lounges) rather than operations data (air traffic control).
But there are fifteen other critical infrastructure segments, including energy:
“The energy infrastructure is divided into three interrelated segments: electricity, oil, and natural gas. The U.S. electricity segment contains more than 6,413 power plants (this includes 3,273 traditional electric utilities and 1,738 nonutility power producers) with approximately 1,075 gigawatts of installed generation. Approximately 48 percent of electricity is produced by combusting coal (primarily transported by rail), 20 percent in nuclear power plants, and 22 percent by combusting natural gas. The remaining generation is provided by hydroelectric plants (6 percent), oil (1 percent), and renewable sources (solar, wind, and geothermal) (3 percent). The heavy reliance on pipelines to distribute products across the nation highlights the interdependencies between the Energy and Transportation Systems Sector.
“The reliance of virtually all industries on electric power and fuels means that all sectors have some dependence on the Energy Sector. The Energy Sector is well aware of its vulnerabilities and is leading a significant voluntary effort to increase its planning and preparedness. Cooperation through industry groups has resulted in substantial information sharing of best practices across the sector. Many sector owners and operators have extensive experience abroad with infrastructure protection and have more recently focused their attention on cybersecurity.”
And obviously the United States is not the only country dependent on energy, as residents of the United Kingdom found out.
“It seems that the Iranians were successful in taking a UK power plant for four days back in July….
“[H]ackers believed to be affiliated with the Iranians were behind the attack. British officials declined to identify the site for security reasons, and the government has described it only as a small-scale energy generator….
“the target was a small gas-fired ‘peaker’ plant. These facilities are designed to provide additional electricity when demand rises or when other sources are producing less power.”
I’ve previously noted that too many identity/biometric companies use the same word—trust—in their marketing. Resulting in non-differentiated sameness and uniformity.
Even though the technical underpinnings behind the companies’ solutions have moved away from the ideas of firewalls, trusted networks, and trusted devices. In today’s mandated zero trust environment, everyone—including your chief engineer—must prove their rights to access information. Every. Time.
Zero trust is even stricter than the Reagan-era “Trust, but Verify.” Which is a 2026 cybersecurity expert’s worst nightmare.
And to truly embrace zero trust in both technological and business contexts, customers must demand that vendors prove themselves continuously.
Some customers don’t make such demands, but others do. I know of a national agency that had been with a vendor for years…and then decided that it was a good idea to learn what the other vendors were offering. After hearing the others, the customer let the original vendor (my then employer) make its own pitch. For a variety of reasons they switched vendors…but haven’t switched since.
If your customers insist on continuous trust evaluation, how can you as a vendor continuously re-earn that customer trust?
“Water and wastewater utilities in at least seven states have now reported cybersecurity incidents involving Internet-facing programmable logic controllers (PLCs), according to the FBI and the Environmental Protection Agency (EPA)….Specific states were not named.”
But at least four incidents HAVE been explicitly named.
“Meanwhile, Minnesota officials announced this week that at least 30 community water systems across the state were hit with malicious cyber activity, and an investigation is ongoing there….
“Four Minnesota city water organizations publicly announced cyber incidents, but others are unidentified. Braham’s water plant went temporarily offline; Plymouth announced impacts to automated controls and cellular-connected equipment at water towers and lift stations; South St. Paul announced a cybersecurity incident on automated controls; and Maple Plain declared a temporary emergency.”
Now perhaps this is just a bunch of instances of kids messing around.
“The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs).”
Yes, Iran. You may recall that we are at war with them.
“In the United States, there are approximately 152,000 public drinking water systems, including 50,000 community water systems, and more than 16,000 wastewater treatment systems. Over 80 percent of the U.S. population receives their potable water from these drinking water systems, and about 75 percent have their sanitary sewerage treated by these wastewater systems.
“The Water and Wastewater Systems Sector is vulnerable to various threats, including physical attacks, cyberattacks, and contamination with harmful agents. Such incidents could result in widespread illness, casualties, and service disruptions, significantly impacting public health and economic stability.”
Messing up someone’s computer is bad enough. But messing up their glass of drinking water is devastating. And whether the damage is done by a state-sponsored terrorist or by Beavis, you want to prevent it from happening.
