-
Research involving 40 cybersecurity leaders across industries reveals that 68% of cybersecurity breaches involve non-malicious human elements, highlighting the critical importance of human risk management.
-
Study identifies key cybersecurity culture challenges including change resistance, secure technology adoption, and management of interconnected systems, suggesting AI could help address these through personalized training and real-time risk detection.
-
The CAMS Cybersecurity Culture Model emphasizes a three-tiered approach (leadership, group, individual) to building security culture, with external influences and managerial mechanisms playing crucial roles in shaping organizational behavior.
-
Survey reveals 70% of CISOs have negative feelings about their role due to increasing personal liability for cybersecurity incidents, with only 10% seeing increased security budgets despite heightened board attention.
-
CISOs face a critical disconnect between accountability and authority, with many security leaders being held responsible for decisions made by committee while lacking direct control over security implementations.
-
Security experts recommend CISOs negotiate protective measures including indemnification, professional liability insurance coverage, and strong exit clauses, as talent drain becomes a growing concern in the industry.
Discover my collection of industry reports, guides and cheat sheets in Cyber Strategy OS.
-
An air-gapped network was infected with a wormable virus, requiring complete system restoration from backup tapes. The incident revealed critical backup reliability issues, with only 80% tape readability and resulted in 2 weeks of data loss.
-
A corporate-wide alert involving 3,000 machines was triggered by Dropbox software update that mimicked APT behavior being studied in a SANS class, leading to unnecessary incident response deployment.
-
Multiple cases of insider incidents were reported where work email systems were misused for personal activities, including dating sites and sharing inappropriate content, requiring SOC teams to collaborate with HR and Legal departments for investigations.
-
Threat hunting focuses on proactively searching for signs of compromise using behavioral analysis tools and threat intelligence, rather than waiting for alerts from existing security controls.
-
Organizations struggle with justifying threat hunting programs due to intangible benefits, requiring security teams to demonstrate value through real-world examples and actionable findings from smaller initial exercises.
-
Security managers report mixed results, with some questioning the return on investment compared to traditional detection engineering, while others emphasize its importance as an early warning system despite well-configured security controls.
-
Survey reveals many practitioners spend significant time on administrative tasks like software licensing, patch management, and device tracking alongside core security duties.
-
Red Team specialists report most focused security work, with 80% of time on pentesting activities and only 20% on administrative, training, and reporting tasks.
-
GRC professionals and consultants indicate heaviest non-security workload, with some spending up to 95% of time on business tasks, documentation, and stakeholder management rather than technical security work.
-
Foreign threat actors gained unauthorized access to generative AI services by using scraped credentials, then resold access to other malicious actors for creating harmful content.
-
Microsoft's Digital Crimes Unit discovered attackers were specifically targeting OpenAI's DALL-E and other AI tools to power sophisticated attacks against third-party organizations.
-
The company has implemented countermeasures including enhanced safeguards and credential revocation, while warning that AI-powered phishing campaigns are becoming increasingly personalized through social media scraping.
-
DHS completed three pilot programs in 2024 focused on investigative lead enhancement, hazard mitigation planning, and immigration officer training - all designed to support rather than replace human workers.
-
The playbook outlines 7 key areas for successful GenAI implementation including mission alignment, governance, infrastructure, responsible use considerations, monitoring, talent development, and user feedback.
-
Emphasizes importance of executive sponsorship and cross-functional governance through integrated project teams comprising cybersecurity, legal, privacy and civil rights experts to oversee development and deployment.
-
Novel defense architecture called LLM-PD introduced, integrating large language models to provide intelligent, proactive protection against advanced cloud-based threats through comprehensive data analysis and sequential reasoning.
-
System features 5 core components: data collection/reconstruction, status/risk assessment, task inference/decision-making, defense deployment/execution, and effectiveness analysis/feedback, enabling self-evolution based on experience without additional training.
-
Experimental results demonstrate superior performance compared to existing methods, with notably high success rates in defending against various attack scenarios including DDoS and MITM attacks through dynamic defense mechanism creation and deployment.
-
1Password is acquiring U.K.-based Trelica to strengthen its Extended Access Management platform, with a focus on detecting unauthorized SaaS applications and managing access controls.
-
Trelica's technology identifies shadow IT by analyzing system logs and browser activity, detecting when employees use unauthorized services or create insecure software integrations with sensitive data repositories.
-
The acquisition will enhance 1Password's enterprise offerings, combining Trelica's SaaS management capabilities with 1Password's existing single sign-on and device security features, though financial terms remain undisclosed.
-
Darktrace plans to acquire UK-based Cado Security, a forensics specialist offering investigation and response solutions across multi-cloud environments, with deal expected to complete in February pending regulatory approval.
-
Integration will enhance Darktrace's ActiveAI platform by combining Cado's forensic investigation technology with existing capabilities, improving data collection across cloud environments and augmenting Cyber AI Analyst functionality.
-
Acquisition follows Darktrace's recent expansion into cloud security with launches for AWS and Azure, addressing growing concerns as research shows cloud/SaaS platforms are common entry points for threat actors.
-
New unified backup platform combines hardware and software into single appliance, supporting up to 150,000 workloads across multiple platforms including VMs, databases, and Microsoft 365, with built-in hypervisor for backup testing.
-
Solution features advanced security capabilities including immutable backups and air-gap protection, along with global source-side deduplication to optimize storage efficiency and reduce network load.
-
Introduces unique pricing model eliminating per-workload licensing fees, allowing organizations to manage up to three backup servers license-free with optional CMS licenses for larger deployments.
Improve Your Cybersecurity Leadership
Join security leaders receiving the most critical insights, strategies, and resources to stay ahead in cybersecurity.
I will never spam or sell your information.
Kunai is a Linux-based system monitoring tool that provides real-time monitoring and threat hunting capabilities.
Fetches known URLs from various sources for a given domain.
Verity is a comprehensive compliance management tool that helps organizations manage their governance, risk, and compliance initiatives.
Before you go
If you found this newsletter useful, I'd really appreciate if you could forward it to your community and share your feedback below!
For more frequent cybersecurity leadership insights and tips, follow me on LinkedIn, BlueSky and Mastodon.
Best,
Nikoloz
