The security stories enterprise IT leaders actually read.
Volume 343, Issue 2 · 20 articles from 5 issues
Treating NIS2/DORA as security tickets stalls compliance; platform teams must own evidence-producing artifacts.
Many European engineering organizations route NIS2 and DORA requirements to the security team as tickets, creating bottlenecks, shadow infrastructure and platform engineers who never own the reasoning behind controls.
The author calls this an ownership failure, noting that security can write the policy but cannot merge the Helm chart.
The post traces requirements to Kubernetes objects, proposes a RACI that works with sprint planning and identifies CNCF projects that produce compliance evidence, while noting it is not legal advice.
A bank GRC leader explains why phishing-simulation click rates mislead and what behavior-focused programs measure instead.
IDFC First Bank's Uma Ramani argues that quarterly phishing drills measure how convincing a fake email was, not whether behavior changed, and that training effects fade within about six months without reinforcement.
Shaming people who click tends to cause disengagement, and research suggests reporting rates are a more honest metric than click rates.
She favors just-in-time coaching at the moment of a risky action and role-specific content, and floats AI voice coaching after a lapse as a promising but unproven idea.
PwC finds no consensus on who owns AI risk, leaving CISOs accountable for AI incidents without matching authority.
PwC research shows only 17% of organizations formally assign AI governance and risk to CISOs, 29% to CIOs, CTOs or technology, 11% split it across functions, and a third have a dedicated role such as a chief AI officer.
Nemertes analyst Johna Till Johnson says a CISO's actual job is to be fired when something goes wrong, and AI is now one of the biggest somethings.
Security leaders argue that if they are held accountable for AI outcomes, they need authority and visibility to match.
Most organizations give CISOs a business-resilience and AI-governance mandate without the authority to carry it out.
The author argues that the modern CISO mandate spans business resilience, enterprise risk, AI governance, workforce readiness and board communication, but most organizations have not granted matching authority.
Proofpoint's survey of 1,600 CISOs found 78% expect to manage AI risk without more resources, and Gravitee found only 14% of AI agents went live with full security approval.
Incidents at Boston Scientific and Jaguar Land Rover show that cyber events now hit production and earnings guidance.
The piece proposes four shifts, including moving from control owner to risk advisor and running readiness exercises that test decisions, even with the CISO unavailable.
Modern intrusions look legitimate, so SOCs need behavioral context over time rather than more alerts, say Exabeam and Swimlane experts.
IT Security Guru gathers experts on why detection must evolve, as Exabeam's Steve Povolny notes attackers have learned the red flags defenders teach, so stolen session tokens authenticate normally, compromised employees use approved apps, North Korean IT workers enter through hiring and AI agents take authorized actions with unintended outcomes.
Swimlane's Nick Tausek says the SOC has a decision problem, not an information problem, since analysts already have abundant alerts and telemetry.
Detection must shift from single events to understanding identity and system behavior over time.
Cyberattacks on Springfield schools and Everett's City Hall show recovery planning must address lost access to systems, not just data.
In September, an intrusion at Springfield Public Schools cut staff off from key platforms, including nurses' medication and allergy records, closing schools for four days, while Everett shut City Hall after a separate incident but kept essential services running.
The article argues the most visible damage came from lost access rather than data theft. Lessons include network segmentation, which kept Everett's separate school network operating, plus MFA, least privilege, asset inventories and prioritizing critical exposures.
It notes 73% of organizations with incident response plans say they couldn't fully execute them, and warns attackers frequently target backups.
Application Security Weekly shares Black Hat 2026 interviews on AI supply chain risks, agents, AI pentesting and emerging threats.
This Application Security Weekly episode features interviews recorded at Black Hat 2026.
Michael Leland, VP and Field CTO of Island, discusses hidden risks in the AI supply chain, noting agents can discover and install tools while the ecosystem of skills and MCP servers lacks trust controls, citing research on 800 fake AI skills and MCP servers delivering malware.
Other guests include former CISO Dr. Sean Murphy, Apiiro's Idan Plotnik and Novee CEO Ido Geffen, whose company builds AI agents for continuous penetration testing to find zero-days and complex attack chains.
Blocking cheap phishing domains is futile; defenders should hunt the attacker's costly, shared proxy servers instead.
The author timed an attacker standing up a live credential-harvesting domain in under 24 minutes, which makes domain blocking a weak metric.
Adversary-in-the-middle phishing kits relay victims to real Microsoft sign-in pages and steal session tokens, and putting them behind CDNs and hostname-gated servers hides the origin so well that scanning, passive DNS and email headers all came up empty in one investigation.
The breakthrough came from a cookie Microsoft set with the proxy's IP address, which the proxy relayed to the victim unmodified, showing that finding servers exposes the attacker's whole infrastructure.
Experts say Cybersecurity Awareness Month's 'Don't Make It Easy for Them' applies to boardrooms: verify controls as AI speeds attacks.
IT Security Guru gathers expert views on this year's Cybersecurity Awareness Month theme, 'Don't Make It Easy for Them,' which Rocket Software's Cynthia Overby says applies to organizations as much as individuals as AI accelerates existing attack methods.
Titania CEO Victoria Dimmick notes many attacks start with neglected network infrastructure, such as an unpatched flaw, an unnecessary internet route, an overly permissive rule or a forgotten temporary exception.
With attackers using automation and AI to find these gaps, controls must be continuously verified rather than assumed.
U.S. Bank CISO Ann Barron-DiCamillo says the role now spans fraud, resilience, third-party risk and AI, so partnerships matter most.
In a Help Net Security interview, U.S. Bank EVP and CISO Ann Barron-DiCamillo says the CISO role has expanded to cover fraud, resilience, third-party risk and AI governance because cyber risk 'knows no borders.'
No single leader can own all of it at scale, so effective CISOs act as conveners, building partnerships across technology, risk, legal, fraud, compliance and business lines.
She also discusses shorter incident reporting deadlines, balancing compliance spending against risk reduction, sharing threat intelligence among banks and teaching American University students that cyber risk is a shared responsibility.
Nol8 CEO Kelly Herrell outlines a 90-day plan to secure AI agent data by controlling data paths, not rebuilding systems.
Kelly Herrell, CEO of Nol8, lays out a practical 90-day strategy for securing data accessed by AI agents, focused on understanding what data agents can reach, what enters their context, and where results go.
He notes hidden exposure often sits in overlooked systems like ticketing platforms, CRM tools, and shared drives that agents can instantly correlate, a task previously limited by manual effort.
With limited early budget, teams should map agent-to-data connections and set enforcement points rather than pursue a full infrastructure overhaul.
Real-time field-level filtering, rather than duplicate masked datasets, lets agents keep needed access while enforcing deterministic policy directly in the data path.
A former Hyatt and United security leader argues asset inventory and identity beat cycling through new tools each quarter.
Drawing on years leading cybersecurity at Hyatt and United Airlines, the author argues that security professionals repeatedly mistake new tactics for a need for new tools, when mastering foundational controls is what actually moves the needle.
AI can deliver real value, but only on a solid foundation of basics. The most troubling gap is visibility: you cannot protect an asset whose location you do not know, and it is worse if you do not know it exists.
With on-premises servers, multicloud environments, endpoints and third-party applications all in scope, an actively maintained inventory across every environment is the critical first step.
Mandiant report warns of autonomous AI security risks including runaway agents and supply chain attacks.
Mandiant's AI Risk and Resilience report highlights growing threats from autonomous AI systems in enterprise environments.
A case study revealed an accounting agent that malfunctioned and made over 15,000 API calls in an hour, costing $50,000.
Threat actors increasingly use AI for multi-stage attacks, vulnerability research, and supply chain compromises.
Organizations need governance controls, identity management, real-time behavioral telemetry, and secure development practices to defend against autonomous threats.
A Honeywell survey finds most critical infrastructure firms lack visibility into building automation and IoT devices.
A Honeywell survey of 603 critical infrastructure leaders found only 16% continuously monitor most building automation systems and just 20% do so for IoT devices.
Organizations with comprehensive asset inventories recovered from major incidents 17 percentage points faster than those without -- 42% recovered within six hours versus 25%.
Legacy equipment lacking authentication or encryption remains a major barrier to visibility.
Notably, compliance audit status did not predict which organizations experienced incidents, suggesting audits alone don't guarantee protection, and only 31% of respondents felt fully prepared for security threats.
SIEM detects threats through data analysis; SOAR automates response actions through coordinated workflows.
SIEM and SOAR serve complementary roles in cybersecurity operations. SIEM collects logs from multiple sources, correlates events, and identifies suspicious activity to alert security teams.
SOAR takes those alerts and uses automated workflows to execute response actions like revoking sessions or blocking addresses.
While historically separate, modern platforms increasingly blur these boundaries by combining detection, automation, AI-powered playbook generation, and unified investigation capabilities into integrated security operations solutions.
Average budgets rose 5% but median growth was 0%, and 55% of CISOs saw budgets flat or cut.
The IANS and Artico Search 2026 Security Budget report, based on over 500 security executives surveyed between April and August 2026, found average budget growth of 5%, up from 4%, but median growth of 0%.
While 64% of CISOs asked for an increase, only 45% received one. Business health drove outcomes: companies beating revenue targets by more than 5% were more than twice as likely to get a double-digit increase as those merely hitting targets, 41% versus 15%, and 71% of VC-backed companies increased budgets against 52% of public companies.
Business or operational risk was the most common justification at 48%, while new regulations and board focus produced the largest average increases.
Organizations need incident response plans with defined roles, rapid detection, and tested recovery procedures.
A modern incident response plan establishes clear organizational roles, accelerates threat detection, minimizes attack impact, and supports recovery from cybersecurity incidents.
NIST SP 800-61 Rev. 3 integrates incident response into broader risk management frameworks. According to the 2026 Verizon Data Breach Investigations Report, software vulnerability exploitation caused 31% of breaches while ransomware appeared in 48%.
Effective plans require asset inventories, offline encrypted backups, quick system isolation, evidence preservation, and post-incident reviews to strengthen future security measures.
Guide to top threat intelligence platforms: CloudSEK, Recorded Future, CrowdStrike, Flashpoint, and Bitsight.
The article evaluates five leading threat intelligence platforms for 2026, with CloudSEK ranking first for its AI-native predictive threat intelligence capabilities.
Recorded Future excels in enterprise CTI, CrowdStrike specializes in adversary attribution, Flashpoint provides dark web collection, and Bitsight focuses on exposure intelligence.
Selection depends on specific organizational needs: initial access vectors, threat attribution, underground source discovery, or deployed technology prioritization.
Key 2026 developments include agentic CTI automation, exposure context integration, AI system threat monitoring, and platform consolidation.
Government and industry leaders say simple attacks remain far more consequential than anything AI is currently doing.
At the Billington cybersecurity summit, government and industry leaders warned that attention on AI threats is pulling focus from the attacks actually causing damage.
Unpatched internet-facing systems, stolen credentials and misconfiguration continue to account for the overwhelming majority of successful intrusions, and none of those require sophisticated tooling.
The concern is budget allocation: AI-branded defensive products compete for spending with basics that remain incomplete. The article is useful ammunition for security leaders trying to fund unglamorous work against pressure to buy something AI-related.
AI is reshaping cyber defenses as attackers automate while organizations redesign security strategies.
Artificial intelligence is transforming cybersecurity on both offensive and defensive fronts. Organizations increasingly rely on AI to detect threats and automate security tasks, while adversaries leverage similar capabilities for faster, scaled attacks.
Companies must evolve beyond traditional network perimeter protection toward identity-focused security, implement stronger authentication methods, and develop operations centers capable of processing massive data volumes.
Modern phishing exploits generative AI to create convincing messages, requiring employees to evaluate context rather than spot obvious flaws.