Founder & CEO, @NCXGroup Cyber Risk as a Business Decision | Distinguished Fellow, Ponemon Institute
Los Angeles, CA
Joined December 2009
- Tweets14.4K
- Following9K
- Followers9.8K
- Likes1.3K
Pinned Tweet
Most businesses still think cyber readiness is about tools, policies, and passing an audit.
The market does not see it that way anymore.
Today, cyber risk is part of how your business proves it is well run, insurable, investable, and ready for scrutiny. Buyers, insurers, regulators, and major partners are not asking what you believe about your security. They are asking what you can prove.
That shift changes everything.
lnkd.in/gZsK8_rK
Going to market? Buyers will ask about your breach history.
Navigate360 confirmed a breach 7 months after it went public. A hacker claimed 93GB.
That gap is a diligence finding. Buyers price findings.
Could you show every incident and the day you disclosed it?
f.mtr.cool/viv90pwwuo
Reposting for visibility.
‼️ New TeamViewer vulnerability (CVE-2026-111585) flips the script... the machine you connect to can attack YOUR computer.
No click needed beyond accepting the session. Researcher got code running on a stock Windows viewer — default settings, defenses on.
Here's how the attack works ↓ thehackernews.com/2026/10/te…
What does a CEO wish he had known before the attack hit?
A ransomware CEO's two brutal lessons.
I sat down with Bill Forster of CEO Zones to walk through what that leader learned — and what it cost him to learn it.
The breach was only the beginning.
f.mtr.cool/uf3iehiypy
Last Sunday, Microsoft made everyone patch the same thing twice. Groundhog Day, with patches.
That same day. Three different bills: the owner running a company, the owner selling one, the buyer across the table.
The fix is the basics.
Read on LinkedIn: f.mtr.cool/bru7luguuz
U.S. cyber premium hit $9.5B in 2025, nearly triple 2020. Endorsements are 53% of policies, 4% of premium. The market knows the difference between bundled and real coverage. Your buyer does too. Review your coverage design before diligence finds it for you. f.mtr.cool/m7yq3spofj
Bregal Milestone just took a majority stake in Nethive, backing its acquisition of JoyComm. PE keeps consolidating SME cyber services because capital follows firms that can prove diligence and remediation capacity at scale.
Can you prove your next target's?
See the deal: f.mtr.cool/bhch97dyp9
Attackers move in hours; most of us patch in weeks. I wrote about why proving the basics beats more tools.
If you own, run, buy, or sell a business, you'll want to learn more about this, and why the next 18 months will decide who stays insurable, financeable, and sellable.
Read "The Man Who Owns the Storm Cellar Just Told Us to Take Cover": f.mtr.cool/o77bep8rdc
Looks like we need to keep our heads on a Swivel.
Hopefully you’ve been talking to your boards for awhile now.
‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet.
In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices.
Tailscale says a fix is coming.
Read - thehackernews.com/2026/10/un…
This is one of the best interviews I've seen on the fine line between success and failure, what sustained success really means, and what it takes to achieve it over a lifetime.
Watch it.
youtube.com/watch?v=Axv-1C9-…
I guess it's my day for things that make you 🤔
网景创始人 、硅谷顶级投资人Marc Andreessen 在访谈里坦言，他看到了科技史上最可怕的一道认知鸿沟，
传统巨头以为 AI 只是个降本增效的插件，而新一代 AI 原生团队，正在用完全非人的组织效率掀翻整个商业版图。
当年写出网景浏览器、见证了整个互联网三十年兴衰的 Marc Andreessen，坐在 Ben Horowitz 面前直接发出了感慨，
如果 1994 年我们做 Netscape 的时候就有今天这种 AI 工具，那简直不可想象。
现在绝大多数传统巨头和现有企业，依然在用改良软件的旧思维去看待大模型。
在他们的组织逻辑里，AI 只是一个高级功能，用来给现有业务做个插件、在钉钉里加个智能助手、或者把客服团队砍掉 20% 省点成本。
他们以为自己在拥抱变革，其实只是在给老旧的蒸汽机打补丁。
但真正恐怖的事情，正在那些刚成立的 AI 原生团队里发生。
那些创始人对 AI 能力的理解，跟大厂完全不在同一个平行宇宙。
他们每周都在看着底层技术飞速进化，而且他们压根不会把自己定义成一家软件公司、硬件公司、甚至是一家 AI 公司。
以前创办一家公司，你的组织架构是按人类的协同瓶颈搭出来的：
招产品经理写文档、招工程师写代码、招法务改合同、招运营做投放。
因为人类的脑力带宽有限，所以必须靠庞大的部门和管理层级来支撑业务。
而真正的 AI 原生物种，是用机器智能作为最底层的骨架。
两个人加上一整套自动化 Agent，可以直接把从市场洞察、软件工程、全栈设计到商业销售的链路全部跑通。
他们不是在效率上快了 30%，他们是在组织形态上彻底跨越了一个物种。
大厂的盲区，从来不是买不起算力，而是他们无法理解组织本身才是最大的负债。
当现有企业还在开会讨论如何把 AI 塞进现有的业务流程时，新一代的野蛮人正在用完全超越行业界限的方式，把传统的业务流程连根拔起。
未来拉开人与人、公司与公司之间差距的，根本不是你用了哪个模型，而是你到底是在用新工具维持旧世界的体面，还是用新世界的底层逻辑，重新定义了自己能做的事情。
If you've built a business and are thinking about what comes next, this one's for you.
I got fired three times. Started NCX Group with $3,000. What I learned shapes how we protect sell-side owners today.
Your story is your valuation. Protect it.
Tune in to the episode on the Bite Size Security podcast: Fired Three Times: The Story Behind 25 Years of NCX Group f.mtr.cool/lnz203rttq
Mike Fitzpatrick retweeted
Our founder and CEO, Mike Fitzpatrick, and Bill Forster, founder of CEO Zones, break down what’s really at stake when ransomware strikes.
A 250-person firm was down for 40 days.
Watch the short.
Ransomware took a 250-person firm down for 40 days.
The breach isn't the real number. Third-party risk, downtime, and cyber posture decide your deal.
Bill Forster the Founder of CEO Zones and I break down what's actually at stake. Watch the short: f.mtr.cool/26rccacq4i
Ransomware took a 250-person firm down for 40 days.
The breach isn't the real number. Third-party risk, downtime, and cyber posture decide your deal.
Bill Forster the Founder of CEO Zones and I break down what's actually at stake. Watch the short: f.mtr.cool/26rccacq4i
Mike Fitzpatrick retweeted
What did diligence miss in the IonQ/Elisity deal? NCX Group founder and CEO Mike Fitzpatrick breaks down the risk angle most coverage overlooked.
IonQ's $1.3B all-stock bet on Elisity comes with no published diligence findings. No valuation methodology. Just a number.
Most people read this as a technology story. I read it as a diligence story.
Elisity sells Zero Trust security. Who independently validated its own posture before close?
The seller's risk becomes your risk at close. Price it, or inherit it.
f.mtr.cool/767snvixhp
IonQ's $1.3B all-stock bet on Elisity comes with no published diligence findings. No valuation methodology. Just a number.
Most people read this as a technology story. I read it as a diligence story.
Elisity sells Zero Trust security. Who independently validated its own posture before close?
The seller's risk becomes your risk at close. Price it, or inherit it.
f.mtr.cool/767snvixhp
FYI. I’ve seen this from several sources today.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Last year, I sat through a day-long seminar on selling a business under a pseudonym. I didn't want anyone to know I was there.
In fairness, going undercover isn't unusual for me. Social engineering- testing whether a friendly stranger can talk their way past the front desk- is a regular part of what we do. I didn't go full Fletch, but I'll admit I was tempted. :-)
The seminar was put on by a large M&A firm that handles more than 300 middle-market transactions a year. Eight hours on selling your business.
Not one word about cyber risk.
Allianz ranks cyber incidents as the number one business risk in the world, for companies of every size. In eight hours, it never came up.
That day is when we started formalizing our transaction work at NCX Group.
I'm not selling. Nothing is changing at NCX. But I'm a business owner, and like almost everyone who starts a business, I've thought about it.
You may have, too. You may not have told anyone yet.
If you've owned your business long enough, you've led it through 9/11, the Great Recession, and the pandemic. You've seen just about everything.
Now there's one more thing to get right: the largest transaction of your life.
Before you tell anyone, ask yourself one question: who on your team is independently evaluating cyber as a business risk, not just an IT issue?
I wrote about where to start.
Thinking About Selling Your Business? Where to Start Before You Tell Anyone linkedin.com/pulse/thinking-… via @LinkedIn
Your IT team runs security. Who validates it?
The operator can't validate the operator. Your bookkeeper doesn't audit the books.
Your board deserves proof.
Read how we approach this: f.mtr.cool/z12lohgjum
I got fired the day my son was born. Two more terminations later, I started NCX Group with about $3,000 and a wife who believed in me.
As we head into year 25, here’s the story I’ve hesitated to tell.
Without her, this story never happens.
25 Years of NCX Group: It Started With Getting Fired linkedin.com/pulse/25-years-… via @LinkedIn
