Chris Bollerud, MBA, CISSP, CISM
San Jose, California, United States
3K followers
500+ connections
About
The thing I care about most in technology is making complex systems simple. Not easy, but…
Activity
3K followers
-
Chris Bollerud, MBA, CISSP, CISM shared thisI am now CISM certified by ISACA.Certified Information Security Manager® (CISM) was issued by ISACA to Chris Bollerud.Certified Information Security Manager® (CISM) was issued by ISACA to Chris Bollerud.
-
Chris Bollerud, MBA, CISSP, CISM reposted thisChris Bollerud, MBA, CISSP, CISM reposted thisSeries D + Launching AI Agent Studio: Turning SOPs into Digital Coworkers Today we’re sharing two big milestones at AppZen: our Series D funding of $180 mil and the launch of AI Agent Studio—a new way for Finance teams to run work with digital coworkers, not just more automation. Why this matters Finance is moving from “more automation” to AI that actually runs the work—governed, explainable, and fast. Our AI Agents convert the SOPs you already trust into digital workers that execute across AP, T&E, and corporate cards, with decision traces, approvals, and human-in-the-loop safeguards built in. What’s new with AI Agent Studio From SOPs to Agents in minutes: Upload your playbook or start from best-practice templates. Governed by design: Versioning, approvals, and full audit trails. See the “why”: Decision traces show data, reasoning, and evidence for every action. Simulate safely: Backtest on historical data or run live shadow mode before go-live. Early outcomes we’re seeing High autonomous processing in expense audit and AP Faster cycle times and lower unit costs Full transparency into how decisions are made Thank you To our customers and partners—thank you for the trust, the tough use cases, and the constant feedback that shaped this product. To the AppZen team—your execution made today possible. Product video: See an agent built from an SOP, simulated with guardrails, and deployed to production If you’re ready to try it, let’s build your first Agent together. #CFO #FinanceTransformation #AI #AgenticAI #DigitalWorkers #AccountsPayable #ExpenseManagement #SharedServices #AppZen
-
Chris Bollerud, MBA, CISSP, CISM reposted thisChris Bollerud, MBA, CISSP, CISM reposted thisThe ISC2 Silicon Valley chapter has grown into an amazing community of experts, practitioners, thought leaders - who are happy to come together on the second Tuesday of every month. It is a pleasure and privilege to be a part of it. Come join us next month on Tuesday, Sept 9 for our next exciting session! Thanks to our brilliant speaker Megan Connolly from Rapid7 who stepped in for Jeffrey G. at the last minute - the community did not miss a beat in our learning experience about Continuous Threat Exposure Management (CTEM) for today's increasingly complex attack surface. Great job Megan Connolly! James Pham, CEO of Opsin brought his enthusiasm and amazing sense of humor to his talk about the risks of oversharing and data exposure with GenAI. This led to a highly interactive conversation about data governance and that this challenge spans all platforms, be it Microsoft Copilot, Google Cloud Gemini and others. Big thanks to James Pham! The attendees enjoyed freshly baked pizzas and delicious curated salad at the meeting- thanks Jayshree Desai, CISSP! Thank you to our sponsors and partners! Twine Security, Zafran Security, Salt Security, Rapid7, Illumio, BigID, Horizon3.ai, Axonius, Black Duck, Robert Half and Heritage Bank of Commerce. Chris Bollerud, MBA, CISSP, Evan Stewart, Alexander J. Dita, OiFun T, CISSP, Jayshree Desai, CISSP, Kiran Khanna, Steven Nguyen #ISC2 #ISC2SV #CloudSecurityAlliance #Cybersecurity #SiliconValley #justkeeplearning
-
Chris Bollerud, MBA, CISSP, CISM reposted thisDo you have your front row seat to this event tomorrow? Register here for last few slots : https://lnkd.in/gtyJ9maYChris Bollerud, MBA, CISSP, CISM reposted thisISC2 Silicon Valley Chapter's next monthly chapter meeting is Tuesday, August 12th from 6pm-8pm We welcome Jeffrey G. Gardner from Rapid7 and James Pham from Opsin to this month's training session. It promises to be full of depth and learnings as we try to keep with the rapid evolution of GenAI. Thank you for your time and our membership looks forward to learning from you! Please register here: https://lnkd.in/gtyJ9maY Thank you to our sponsors: Twine Security, Rapid7, Zafran Security, Salt Security, BigID, Illumio, Horizon3.ai, Axonius and Black Duck! Special thank you to our generous partners: Heritage Bank of Commerce and Robert Half! Chris Bollerud, MBA, CISSP, Evan Stewart, Alexander J. Dita, OiFun T, CISSP, Jayshree Desai, CISSP, Kiran Khanna, Bay Sec Alliance, Justin Woody, Catrina Atanda, Anthony Rodriguez, Domenic Trapani, Sami Aryapour, Jeff Bracken, Travis F Johnson, David Affonso, Cody Fultz, Ross Kemp #ISC2 #ISC2SV #CISSP #Cybersecurity #SiliconValley #InfoSec #BaySecAlliance
-
Chris Bollerud, MBA, CISSP, CISM posted thisVibe coding is coming, whether we want it or not. Out of the box, generated code is poorly written and insecure. The question should not be whether we allow it or not, but instead, how do we ensure it will be secure when our engineers use it? I see an opportunity. By default, our engineers write insecure code; by default, Vibe coding engines write insecure code. In the past, we have implemented secure code training to encourage better code. Now we can implement rule sets/prompts that control the Vibe code engine to write secure code. Imagine this, we can create a policy that engineers must use profiles/rules/prompts that cause Cursor, Junie, ChatGPT, Claude, etc, to write code that takes all OWASP concerns into its algorithm. Instead of begging engineers to fix the latest vulnerabilities, we can update the rules. I hope to see a day when not only Critical and High vulnerabilities are handled, but Medium and Low Vulnerabilities are fixed as part of the daily routine.
-
Chris Bollerud, MBA, CISSP, CISM shared thisRSA has been great!! They've been focused on Socks ... SOX ... no Socks. I placed them under Antarctica :-). Crowdstrike had a nice twist, slippers.
-
Chris Bollerud, MBA, CISSP, CISM shared thisLot's of great cybersecurity professionals to meet at BSides SF. There's still a day left to enjoy the exhibits and sessions.
-
Chris Bollerud, MBA, CISSP, CISM reposted thisAs an #AI company #AppZen has been transforming T&E, AP and Card processes at Fortune 500 companies for the last 10 years. From AI Agents that actually do the work to discussing what AI first teams look like, we have a ton to share! This is an in person event, make sure you save your spot now!Chris Bollerud, MBA, CISSP, CISM reposted this🔥 AI is revolutionizing finance, and we're bringing the revolution to YOU! AppZen on Tour 2025 isn't just another event—it's your exclusive pass to witness groundbreaking AI finance technology in action. Join us in Austin (May 8), Frankfurt (May 15), or Atlanta (June 12) for an experience that will transform how you think about financial operations. Don't just read about AI transformation—experience it firsthand! 👉 Seats are filling fast! Secure yours now. https://okt.to/pPUMOZ #AppZenOnTour #FinanceRevolution #AIInnovation
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisTitles are nice — clarity is nicer. I hear vCISO and Fractional CISO used interchangeably all the time. In practice, they map to different delivery models: vCISOs are typically firm‑backed, pod‑based services focused on advisory and program delivery; Fractional CISOs are single, senior individuals embedded part‑time as an operational exec. One brings breadth and productized tiers, the other brings a named, accountable leader. Leadership lesson: Pick accountability over optics. Leaders who need decisive governance and board confidence should prioritize a clear, named owner for security decisions; if you want flexibility and cost efficiency, a firm‑delivered vCISO can work (but don’t confuse convenience with authority). Security & privacy takeaway: Regulatory frameworks and governance expectations favor a single, answerable person. Where rules demand a designated security official or where boards expect a “wringable neck,” the Fractional CISO model usually aligns better with compliance and liability needs. Align contracts and reporting lines so responsibility is explicit. If you’re hiring security leadership, match the model to the outcome. Clarity, control and regulatory fit beat catchy titles. Happy to discuss which approach fits your organization. #LeadershipFirst #ClearAccountability #ChooseWisely #SecurityStrategy #NoNonsense #GrowthMindset #CareerGrowth #ContinuousImprovement #ProfessionalDevelopment #Adaptability #InfoSec #GRC #RiskManagement #DataProtection #Privacy #vCISO #fractional #fractionalCISO #FractionalCxO #vCxO #DeliveryModels #outsorcing #leadership #accountability #governance #authority #AI #slop
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked this"Anthropic's Mythos can hack any codebase for $20K" is a lie. Here's what they're not telling you: The $20K is the cost of the successful run. After thousands of attempts. After building the scaffold. After human review. It's like saying "I found gold for $50" after spending $500K on equipment and 200 failed digs. The real cost? R&D, infrastructure, failed experiments, human verification. None of that is in the $20K. But here's where it gets interesting. Stanislav Fort at AISLE just tested Mythos's flagship vulnerabilities on small, cheap, open-weights models. The results: → 8 out of 8 models detected the FreeBSD bug Anthropic showcased → A 3.6B parameter model at $0.11/M tokens found it → A 5.1B model recovered the full OpenBSD exploit chain → Every model identified the vulnerability as critical RCE The catch: they isolated the vulnerable function first. Provided architectural context. Pointed at the needle, then asked "is there a needle here?" That's not the same as sweeping an entire codebase blind. But here's what that actually proves: The moat isn't the model. It's the system around it. Mythos isn't magic. It's a scaffold that knows where to look, how to verify, and when to stop. Any model could do this with the right harness. The jagged frontier is real. Qwen3 32B scored a perfect CVSS on FreeBSD, then declared the OpenBSD code "robust to such scenarios." No stable "best model" for security. AISLE has 180+ CVEs across 30+ projects using multiple models. Not just Anthropic's. The "too dangerous to release" framing? Marketing theater. "Enterprise customers only" doesn't sound as scary as "we built a superhacker." The capability is real. Automated vuln discovery + exploit generation + verification is a phase change. But $20K to hack any codebase? That's the headline they wanted. Not the truth. Full breakdown from Stanislav Fort 🔗 https://lnkd.in/eD28kEQQ What's the actual cost when you factor in everything they're hiding? 👇 ♻️ Repost for someone who fell for the marketing.
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisSpent last evening at MUFG's CIO/CISO Think Tank, and the conversation I keep replaying in my head is "build vs buy". It came up in almost every thread. And the pattern I heard from CIOs and others in the room was sharper than the usual "it depends." The emerging consensus: build the point use cases internally, buy the tools that own deeper workflows. Point use cases are where enterprises have the context, the data, and the domain nuance that no vendor can replicate. A quick internal copilot, a narrow classifier, a workflow-specific assistant. These are increasingly cheap to stand up, easy to govern, and create real institutional muscle around AI. But the moment a workflow gets deep, multi-step, cross-functional, touching security, compliance, audit trails, integrations, role-based access, the math flips. Building that in-house means committing a roadmap, a team, and years of maintenance to something that isn't your core product. That's where leaders said they want a partner, not a project. I'll admit I got animated on this one (photographic evidence below, courtesy of someone who caught me mid-argument). A few other threads from the night that stuck with me: - Trust, not ambition, is the actual bottleneck on AI adoption - Probabilistic outputs are forcing a real rethink of how we define "control" - The strategic partners in this cycle will be the ones who treat governance as a first-class feature, not a checkbox Huge thanks to Priya Rajan for hosting this, and to Nishit Sahay and Paul Milkman for setting such an honest tone. These rooms are valuable precisely because nobody is performing. Abdullah Al Daawi Joe Byrne Rahul Sood Tony Rodriguez Tanner Heaphy Chris Umesh Padval Alex Salazar
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisIf you know how these two items are related... You are my kind of people! A one-sided floppy. It was expensive. You pushed a notch on the other side and suddenly, double the storage for free. That is the thing about people who work in IT: We look at what we have. We don't wait for others to solve our problems. We pay attention. And we refuse to accept the limitation. We figure out the workaround before anyone else even noticed the problem. This is still the most useful and important skill. Never the tool. Always the thinking. Were you a hole-puncher? I need to know who's still out there..
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisLast night, MUFG’s Growth & Middle Market Technology Banking team hosted our 6th CIO/CISO Think Tank at the Four Seasons Silicon Valley—an off‑the‑record conversation on AI: Trust, Control, and Competitive Advantage. We host these dinners for a simple reason: AI adoption isn’t being limited by ambition—it’s being limited by trust. Across regulated enterprises and high‑growth technology companies alike, CIOs and CISOs are grappling with the same questions: 1. How do we scale AI when outputs are probabilistic, not deterministic? 2. Where do governance, security, and compliance need to evolve? 3. What separates strategic partners from point vendors in this AI cycle? 4. And how do you unlock productivity gains while maintaining control and accountability? We were fortunate to hear grounded, real‑world perspectives from: Nishit Sahay, CIO, Marvell Technology and our very own Paul Milkman, CISO for the Americas, MUFG. We discussed several key topics incl. buying decisions, architectural tradeoffs, common enterprise pitfalls, and where leaders are leaning in—or holding back—in today’s AI landscape. These intimate, invite‑only conversations are designed to connect founders, investors, and enterprise leaders directly with decision‑makers shaping the future of AI adoption. Thank you to everyone who joined us. The dialogue was candid, thoughtful, and exactly why we continue to create space for these conversations. Photo credit: Tony Chew Abdullah Al Daawi Veronica Ventura Joana Tahiraj Manisha Rohit Jeff Kyle Tanner Wiley Faya Joe Radhika Rahul Jaya Chris Umesh Gal Rob Nishant Kris Jonathan Arvind Vignesh Tony Joseline Rajoshi Alex Abhi Rohit Vedant Gopal #AI #CIO #CISO #EnterpriseAI #TrustInAI #CyberSecurity #TechBanking #MUFG #GrowthandMiddleMarket #Adoption #GTM #Pricing #DefensibilityofAI #Costoptimization #Scale #Global #Talent
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisA CISO was fired the day after a major breach went public. No investigation. No findings. No process. Just a press statement: "the company has made a leadership change in its security function." The CISO had been in the role 14 months. Here's what those 14 months looked like: Month 2 - $800k infrastructure upgrade request. Denied. "Not in this year's budget." Month 4 - Authentication vulnerabilities flagged across legacy systems. Response: "prioritise business continuity over remediation." Month 7 - Third-party penetration test requested. Denied. "We had one two years ago." Month 9 - Board risk report presented. Three critical gaps identified. Noted. No action. Month 11 - Formal written escalation filed with legal and board chair: "current security posture represents unacceptable organisational risk." Month 14 - Breach. Legacy authentication vulnerability exploited. 2.1M customer records exposed. Month 14, day 2 - CISO fired. The press statement mentioned none of it. The CISO's lawyer sent one letter. It contained the full paper trail - every denied request, every ignored escalation, every board minute where the risk was noted and left unaddressed. The company settled quietly. The CISO's name had already been in the press. What that CISO told peers afterward: "Document everything. Every denial. Every override. Every escalation. Not because you're planning to fight - but because the day something goes wrong, you will be standing alone unless you can prove the organisation knew the risk and chose to accept it." The legal landscape is shifting. Regulators are naming individuals, not just companies. CISOs are being held personally liable for organisational failures. But boards are too - when the paper trail shows they were warned. The lesson: a CISO's best defence is never technical. It's a paper trail proving exactly who knew what - and when they chose to do nothing. Document everything. SOC(k)s are on fire courtesy of Anecdotes #ciso #cybersecurity #scapegoat #document #leadership #technology #legal #regulation #compliance #executive
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisRSA week is always a whirlwind, but hosting our SVCI Celebration was a true highlight. What started 6 years ago in a small room has grown into a community of 70+ highly active CISOs, all committed to shaping the future of cybersecurity by supporting the next generation of founders. We’ve backed 20+ startups that have earned the trust and scrutiny of some of the best security leaders in the world. We are grateful to everyone who showed up, contributed, and continues to make this community so special. And a big thank you to our partners Notable Capital and Chime for hosting, and the incredible founders building real signal in all the noise. Let’s go!
-
Chris Bollerud, MBA, CISSP, CISM liked thisChris Bollerud, MBA, CISSP, CISM liked thisGreat start to #RSAC today with the Cyber Leaders Forum. Thought-provoking sessions and I enjoyed the chance to meet Jen Easterly.
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
Licenses & Certifications
Volunteer Experience
-
Past President
ISC2 Silicon Valley Chapter
- Present 2 years 7 months
Science and Technology
Helping to provide networking, professional development, and educational opportunities for information security professionals in the Silicon Valley area.
-
-
Executive Board Member
San Francisco Road Runners Club
- 5 years
Health
Helped set direction of the club, oversaw event planning, technical implementations, marketing, financial decisions and operations.
Patents
-
Process activity and error monitoring system and method
Issued US 6898733
A system and method that uses a process management console to maintain multiple processes that perform software services from within a presentation layer and a database layer. The method includes defining an active process list for a plurality of processes that provide services in the presentation and database layers. Another step is monitoring the plurality of processes that are active in the presentation and database layers by using a process monitor. The next step is determining when one of…
A system and method that uses a process management console to maintain multiple processes that perform software services from within a presentation layer and a database layer. The method includes defining an active process list for a plurality of processes that provide services in the presentation and database layers. Another step is monitoring the plurality of processes that are active in the presentation and database layers by using a process monitor. The next step is determining when one of the processes has abnormally terminated, using the process monitor to periodically compare the active process list to the list of processes currently executing. When a process fails, the system reactivates the process under the automatic control of the process monitor, and the reactivation is performed automatically. The system can also generate an error message that is logged or sent as an email to support personnel when a process has failed.
Other inventors -
Organizations
-
Toastmasters International
Treasurer, VP Education, Club President, Sergeant at Arms
- PresentAdvanced Communicator Bronze (ACB), Advanced Leader Bronze (ALB) Currently working towards Silver Communicator and Leadership awards Study and practice public speaking and giving feedback on a weekly basis with Toastmasters. Have been involved with multiple clubs and in multiple roles.
Recommendations received
4 people have recommended Chris
Join now to viewOther similar profiles
Explore more posts
-
Steven S. George II
Candidate Spotlight: Security Program Leader | Product Security & Enterprise Risk A cybersecurity leader with 15+ years of experience turning complex technical risk into clear, actionable guidance for product and engineering teams. Known for aligning security strategy with business goals, improving developer efficiency, and embedding a secure‑by‑design culture across large organizations. Core Strengths • Product security and cloud security (AWS/GCP) • Security program development and executive influence • Behavioral engineering and security education • Data‑driven risk evaluation and roadmap design • Organizational enablement across all cross-functional teams and pillars, supporting every level of the company. • Revitalized a global Security Champions Program, driving major increases in developer engagement and security task completion • Built metrics‑driven dashboards and role‑specific roadmaps that reduced risk across multiple business units • Integrated optimized IAM strategies and automated security guidance into CI/CD workflows, improving developer efficiency and reducing review times • Led large‑scale bug bounty operations and security research initiatives that strengthened organizational resilience • Delivered high‑visibility security presentations and contributed to industry research and open‑source efforts Earlier Career • Designed and scaled global security training programs for 17,000+ employees with top audit performance • Developed advanced phishing simulations and behavioral interventions that improved real‑world threat recognition • Created security playbooks and documentation used across enterprise knowledge platforms Positioning A trusted, versatile security leader with a proven ability to influence at scale, drive measurable behavior change, and operationalize security as a strategic business enabler. If this aligns with any priorities on your team, I’m happy to facilitate a discreet introduction. CyberExecConnect
1 Comment -
TakeYourPills.Tech
Most SBOMs are just expensive digital paperweights. We generate them to satisfy compliance. Then we file them away and ship the code anyway. That isn't security. That is security theater. Real DevSecOps means empowering developers to be the front line. It means integrating vulnerability scanning directly into the CI/CD pipeline. And most importantly: It means actually breaking the build when a dependency is compromised. If it doesn't block the deploy, it's not protecting anything. I break down exactly how to move from passive scanning to active blocking in today's issue (and daily audio pill). Check the link in the comments to listen or read. 👇 #security #cicd #devsecops
3 Comments
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content