Blog | J Wolfgang Goerlich

Synced passkey security issues could allow account takeover

August 6, 2026

The attacks can misuse trusted workflows to take over passkey-protected accounts, but the attacker must have first breached defenses and planted malware; analysts say the issue is flaws in supporting processes.

Excerpt from: Passkey security issues could allow account takeover

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

Read the full article: https://www.csoonline.com/article/4205751/report-passkey-security-issues-could-allow-account-takeover.html

Wolf’s Additional Thoughts

In 2021-2023, in presentations such as Street Cred and Mistaken Identity, I warned of this exact type of attack. Credential theft and re-use is only possible when the authenticator can be copied, cloned, and replayed. That’s exactly what synced passkeys allow. It’s frustrating but entirely unsurprising to see this happen. If you must shared passkeys, use enterprise credential managers like 1Password and others.

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

Techstrong interview on IANS new MCP

July 27, 2026

The first cybersecurity MCP server is here. Wolfgang Goerlich, IANS faculty member and public sector CISO, joins Alan Shimel on how IANS now surfaces peer research inside Claude and other AI clients. Furthermore, Wolfgang and Alan unpack whether AI is really rotting our brains or quietly sharpening the pros who use it well.

Wolfgang came up in the golden age of security alongside Alan. Consequently, he brings decades of hands-on CISO perspective across healthcare, financial services, tech and public sector engagements. Meanwhile, his IANS faculty seat gives him a front row view of what practitioners are shipping today.

Inside the first cybersecurity MCP server IANS is a practitioner-led research and intelligence network for CISOs. As a result, its new MCP server lets clients pull that research directly into a Claude prompt while they draft a policy or standard. Meanwhile, one of Wolfgang’s own runbooks got refreshed in minutes rather than weeks.

Alan pushes on the details. In addition, the cybersecurity MCP server is scoped to IANS clients and faculty, and it feeds real quotes, insights and polls back into the prompt. Therefore, teams stop guessing what generic AI thinks and start acting on what their peers actually did, whether they are updating a runbook, a policy or a fresh standard.

Why every CISO should watch the cybersecurity MCP server story Alan and Wolfgang widen the lens to the de skilling debate. Meanwhile, the latest studies suggest AI power users sharpen their thinking by interrogating outputs rather than accepting them. Consequently, the gap between passive and active AI users is widening across security teams.

Wolfgang also weighs in on MCP protocol security, comparing today’s posture to the early days of API security. Furthermore, he explains why 170 practitioner-faculty members give the platform an edge as vulnerabilities surface. Learn more at iansresearch.com.

Revisiting lessons learned from LastPass 2022

January 15, 2026

Old data breaches never die. Especially when regulators shine a light on them. Last month, the UK’s Information Commissioner’s Office (ICO) put a 2022 incident at password management company LastPass back in the news cycle, after fining it £1.2m for GDPR infringements.

Excerpt from: AI Autopsy: Why the ICO fined LastPass £1.2m

Although LastPass subsequently changed its policy, at the time of the incident, it allowed employees to link their LastPass business and personal accounts, meaning that both could be accessed with the same master password.

This was a key gap in the firm’s security posture, says Wolfgang Goerlich. “The LastPass incident shows that logical separation without trust separation is a security flaw,” he tells Assured Intelligence. “We must separate personal, daily professional, and privileged activities. That separation begins with credential stores and extends into accounts, profiles and computing hardware.”

LastPass’s failure to mandate this at the time enabled the attacker to access the decryption key in the engineer’s Employee Business Vault, thereby decrypting the SSE-C key. It also got them the AWS access key. With those assets in hand, the attacker could access the AWS backups.

The ICO’s penalty notice specifically cites the failure to mandate the separation of personal and business accounts, particularly for senior executives who were high-profile targets.

Read the full article: https://assured.co.uk/2026/ai-autopsy-why-the-ico-fined-lastpass-1-2m/

AI in cybersecurity operations

August 25, 2025

AI’s emergence as a transformative force is spurring CISOs to rethink how their teams operate to harness the technology’s potential and better defend its use across the organization.

Excerpt from: How AI is reshaping cybersecurity operations

Goerlich observes, “The future of security operations is going to be AI versus AI. It’s going to be machine on machine, with people in the cockpit making sure the right things are happening — or on the adversity side, making sure their attacks will be carried out. That’s really going to make us rethinking how we’re doing our security operations.”

Read the full article: https://www.csoonline.com/article/4042494/how-ai-is-reshaping-cybersecurity-operations.html

Wolf’s Additional Thoughts

The part I’m continually working on, and sometimes struggling with, is where and when to deploy AI. Our people need to be better and stronger. You don’t get stronger by renting a forklift to lift the weight, you get stronger by lifting the weights. Similarly, we won’t get smarter by getting an AI to do the work. That said, many areas immediately benefit from automation and don’t weaken the team through automation. Those are the sweet spots I look for, with AI in the SOC.

Multi-cloud Security challenges

July 11, 2025

From inadequate visibility to access management complexity, multicloud environments take baseline cloud security issues to another level.

Excerpt from: 5 multicloud security challenges — and how to address them.

Some CISOs opt to have a single security program for their entire cloud environment while others take a cloud-specific approach. Each strategy has pros and cons, says Wolfgang Goerlich, IANS Research faculty and a public sector CISO.

“If you’re treating all clouds the same, if you have a unified security program, then that means you’re not using the native security tools and you’re not driving the value out of each cloud. And not all solutions will pull in data [from each cloud provider] with fidelity, and not all apps will be as granular as the native tools,” he explains. “But if you go native, if you do a deep dive into each cloud, you add more tech and you probably won’t have teams who can work across the different clouds, so you create more challenges with processes, staff, and technology.”

Goerlich doesn’t list one option as better than the other but instead stresses the need to weigh the benefits and drawbacks of each one when devising an enterprise security plan.

“It’s all about the tradeoffs,” he says. “You can organize your team by cloud to drive more value from native capabilities, or have your team know enough about each cloud to effect change, or take it to a high level and not use the native tools.”

Read the full article: https://www.csoonline.com/article/4009247/5-multicloud-security-challenges-and-how-to-address-them.html

Wolf’s Additional Thoughts

It is the tug‑of‑war between unified vs. cloud‑specific security controls. It is a balance between manageability and defensibility. Often the culture of the organization and the design of the InfoSec team makes more of a difference than a specific tool or strategy.

Balance business continuity with other responsibilities

April 2, 2025

With business continuity, CISOs must navigate a complex mix of security, business priorities and operational resilience — often without clear ownership of the process.

Excerpt from: How CISOs can balance business continuity with other responsibilities

While CISOs may find that their remit is expanding to cover business continuity, a lack of clear delineation of roles and responsibilities can spell trouble.

It’s becoming more common to be part of the CISO toolkit, but there’s still a lot of back and forth around who should own BCDR and how widely it should be deployed, according to Goerlich. “I’ve been in organizations where BCDR was something done separately, where we were a partner, but not directly involved. I’ve been in other organizations where I was the primary driver of the program,” says Goerlich.

Whether or not the CISO defines downtime metrics depends on who has responsibility for the program, says Goerlich. Either way, it’s driven by the pain the organization feels according to the business impact analysis. For example, recovery time objective (RTO) will vary according to the industry and relevant considerations such as safety in manufacturing and healthcare and integrity or business process completion rates in financial services.

“When it comes to third-party risk and supply chain management, if it’s the CISO’s responsibility, it’s taking all the work the CISO is doing and adding BCDR requirements to it and then re-auditing,” says Goerlich.

In one case, he assisted a bank to audit its SLA, starting with matching its internal SLAs to the service providers SLAs and then conducting spot visits with some of those service providers to see if they could deliver on those SLAs. “Many of them weren’t as prepared as they said, many had strategies that were ineffective, and many had things the sales team was promising, that the technical team was unaware of or unable to respond to,” he says.

The confusion about who owns ultimate responsibility for business continuity and disaster recovery is part of the ongoing CISO struggle to become a true business partner.

Read the full article: https://www.csoonline.com/article/3855823/how-cisos-can-balance-business-continuity-with-other-responsibilities.html

Wolf’s Additional Thoughts

I grounded my security program at Munder Capital on our BCP/DRP. In my current role as CISO of Oakland County, I’m again involved in the continuity and recovery program. These provide a rich set of inputs on what matters to the organization, allowing for informed and intelligent risk management. Don’t overlook it.

Text Message Scams

August 27, 2024

Don’t click on the link you received about unpaid tolls. It’s likely a scam.

Excerpt from: If You Get This Text Message, It’s Probably a Scam.

Unpaid toll scams are on the rise, according to the FBI. The agency has received more than 2,000 complaints since March. Unpaid toll scams are classified as smishing, whereby bad actors use text messages and pretend to be a part of a company to extract your personal information.

Toll road scam texts often convey a false sense of urgency. This tricks you into acting quickly before you even consider the possibility that it may be a scam.

“Scared people moving quickly make poor decisions, which is exactly what a scammer wants,” Goerlich said. “If a message makes you feel rushed or afraid, trust your intuition and stop responding.”

Read the full article: https://www.cnet.com/personal-finance/identity-theft/if-you-get-this-text-message-its-probably-a-scam/

Wolf’s Additional Thoughts

Take a beat, take a moment, center yourself, and click from a place of calm. That’s my security awareness advice. While the tactics have changed over the decades, the one thing scams have in common is scaring people into move action. So give yourself a time to think.

Frameworks and Relationships

July 29, 2024

“Today we welcome J Wolfgang Goerlich, an advisory CISO, mentor, and strategist. We delve into the intricacies of security design frameworks and the importance of building and maintaining relationships in the cybersecurity field. Wolfgang shares his expertise on creating effective security programs, fostering trust within teams, and navigating the challenges of the CISO role. Tune in to gain valuable insights on cybersecurity strategy and the significance of collaborative relationships in achieving security goals.”

Ways CISOs Can Stay Ahead

July 25, 2024

Security leaders are expected to defend their organizations against existing and emerging threats. Here are some tactics they can use to crack down on the enemy.

Excerpt from: 9 Ways CISOs Can Stay Ahead of Bad Actors

It is often said that CISOs need to be right all the time and bad actors must only be right once. According to Wolfgang Goerlich, faculty member at independent cybersecurity research and advisory firm IANS Research, that mindset is counterproductive.

“That’s not the case. The criminals are fast, they’re strong, but there are things we can do. I’ve always started with threat intelligence [because] I want to know what the criminals are doing, what their tactics and procedures are. I want to know some good ways to stop them in ways that don’t interfere with my organizations,” says Goerlich. “Security is only as good as the last time you checked, so we will do tabletop exercises, drills, red team exercises and test all those ways a criminal would move through our environment, and ensure we have multiple ways to stop and catch them.”

There are many other things CISOs are doing to stay a step ahead. The following are some examples.

Read the full article: https://www.informationweek.com/cyber-resilience/9-ways-cisos-can-stay-ahead-of-bad-actors

Things to Consider When Buying a Password Manager, U.S. News

April 25, 2024

Modern life means the proliferation of passwords. From banking to BBC iPlayer, nearly every website or application requires creating a password. But remembering multiple passwords is cumbersome and using the same easy-to-remember password for every application is a security nightmare. This is where password managers have come into their own

Excerpt from: Best Password Managers in the UK

Things to Consider When Buying a Password Manager

Security features and encryption. “It’s important to determine whether your passwords are safeguarded with multi-factor authentication and if the protection is structured so that only you have access to your data,” says Wolfgang Goerlich, faculty member at cybersecurity research and advisory firm, IANS Research. “This is commonly known as zero-knowledge architecture, which is a great way of saying that the vendor cannot access my passwords and secrets.”

Data backup and sync. For business users with “higher demands on the availability and integrity of their password manager”, Goerlich says that it is important to look into data recovery options, especially if the product is cloud-based: “If the cloud becomes unavailable, the password managers need to be able to continue to function.

Read the full article: https://www.usnews.com/uk/360-reviews/privacy/password-managers