At Black Hat 2025, I talked with Danny Jenkins, CEO at ThreatLocker, about a sobering statistic: 90% of successful ransomware attacks happen because security tools weren’t properly configured. Organizations have defenses in place, but they are not set up correctly.

To combat this, ThreatLocker developed DAC (Defense Against Configuration) by analyzing tens of thousands of support tickets to identify the most common configuration mistakes, then building automated checks to prevent them. The system runs 170 daily checks on every endpoint.

Most security teams set up defenses with good intentions on day one, but configuration drift is inevitable. As Danny put it: “If you think something in cybersecurity is set and forget, you’re going to get bit in the backside.”

The real challenge isn’t deploying security tools, it’s keeping them working as intended months later.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, ThreatLocker