-
Forrester analysts Chiara Bragato and Jinan Budge analyzed the representation, career paths, and tenure of CISOs in top APAC companies. They found that despite extensive experience, many CISOs struggle to secure a spot in the executive suite.
-
The majority of APAC CISOs (69%) hold STEM degrees, but only 35% of master's degrees are MBAs. Many CISOs acquire certifications more suited to practitioners than senior executives.
-
Women face significant challenges in attaining and retaining CISO roles in APAC, accounting for only 9% of CISOs. The average male CISO has been in their role 34% longer than their female counterparts.
-
Srikumar Ramanathan, chief solutions officer at Mphasis, says common forms of security technical debt include overreliance on outdated security tools, inadequate security by design, and poor software development practices.
-
Solution debt arises when the security stack lacks the controls or functional capabilities to keep up with managing risk in a modern IT environment and detecting the newest attacker behaviors, according to Maxime Lamothe-Brassard, CEO of LimaCharlie.
-
Tool sprawl and integration debt occur when security departments suffer from both solution debt causing coverage gaps and rampant tool sprawl eating up budget, making it difficult to effectively use tools, as experienced by Andrew Kim, managing director and cyber strategy lead for Accenture Federal Services.
Improve Your Cybersecurity Leadership
Join security leaders receiving the most critical insights, strategies, and resources to stay ahead in cybersecurity.
I will never spam or sell your information.
-
CertPreps, is offering free practice exams for their Certified in Cybersecurity certification.
-
The practice exams, while not containing actual exam questions, are designed to closely simulate the real test and significantly increase candidates' readiness and preparedness.
-
(ISC)² recommends that candidates who can comfortably score 70% or higher on these practice exams will be well-prepared to pass the official Certified in Cybersecurity certification exam.
-
Josh Sokol, the author, says writing well on a regular basis takes a lot of effort and there are no shortcuts - aspiring writers need to set aside dedicated time.
-
Finding creative angles to approach security topics and taking inspiration from the world around you can help generate fresh material to write about regularly.
-
Writers should know their audience, speak their language, provide practical and actionable takeaways, stay focused despite distractions, and follow through to create finished pieces that deliver value to readers.
-
Redditor, a 29-year-old cybersecurity professional, shares their $220k salary and recommends the field to others.
-
Emphasizes the importance of having a strong foundation in IT and networking fundamentals, along with hands-on experience through homelabs or in the field.
-
Suggests pursuing a Computer Science degree with a minor in cybersecurity, and highlights the value of certifications like Security+, Network+, CEH, and Pentest+, while cautioning against attempting advanced certs like CISSP or OSCP without sufficient experience.
-
A recent Gartner survey found that 73% of enterprises have hundreds or thousands of AI models deployed, and 41% reported experiencing an AI security incident, including adversarial attacks targeting ML models.
-
Adversarial attacks exploit weaknesses in data integrity and ML model robustness, with types including data poisoning, evasion attacks, model inversion, and model stealing, posing risks to sectors like finance, healthcare, and autonomous vehicles.
-
The growing complexity of network environments demands more sophisticated ML techniques, creating new vulnerabilities for attackers to exploit, with adversarial ML attacks on network security reaching epidemic levels according to researchers.
-
Alon Shwartz, the author, suggests that the recent downturn in tech stocks, particularly those heavily invested in AI, underscores the mounting pressure on CISOs to demonstrate that AI can deliver measurable results in cybersecurity.
-
CISOs must ask critical questions before integrating AI into their cybersecurity strategies, such as determining where AI can have the greatest impact, relying on proven use cases like UEBA, and ensuring access to high-quality data.
-
AI may not yet be the best solution for immature or emerging attack surfaces like APIs, where fundamental security practices may still be evolving, and the lack of reliable data can hinder AI's effectiveness.
-
The AWS Customer Incident Response Team (CIRT) has developed a methodology for investigating security incidents involving generative AI applications, building on their existing Security Incident Response Guide.
-
Generative AI workloads include components like foundation models, custom models, guardrails, agents, knowledge bases, training data, and plugins, which require additional considerations during incident response.
-
The new methodology consists of seven elements to consider when triaging and responding: access, infrastructure changes, AI changes, data store changes, invocation, private data, and agency.
-
Torq, a New York-based startup, has raised $70 million in a Series C funding round led by Evolution Equity Partners, bringing the total raised to $192 million.
-
The company's flagship product, Torq HyperSOC, uses AI and natural language processing to automate threat investigation, triage, and remediation for enterprise security teams.
-
Torq has found traction with high-profile enterprise clients, including Procter & Gamble, PepsiCo, and Siemens, aiming to alleviate alert fatigue and resource constraints in security operations.
-
According to people with knowledge of the matter, cybersecurity startup Wiz Inc. is in discussions to sell existing shares at a valuation ranging from $15 billion to $20 billion.
-
The potential transaction would allow existing shareholders to tender $500 million to $700 million of their holdings, and Wiz may also raise money directly from investors.
-
In July, Wiz turned down a $23 billion acquisition offer from Google, deciding it could ultimately be worth more as a public company and expressing concerns about a lengthy regulatory approval process.
-
Tamnoon, a leader in Managed Cloud Security Remediation, has secured $12 million in Series A funding led by Bright Pixel Capital, with participation from new investors Blu Ventures and Mindset Ventures, as well as existing backers.
-
Tamnoon's unique hybrid human-AI managed service is specifically designed for cloud security remediation, integrating artificial intelligence with human intelligence to provide a scalable, expert-guided remediation process without disrupting business operations.
-
The funding will be used to accelerate Tamnoon's product roadmap, expand its partnership ecosystem, and drive innovation in managed cloud security remediation, with the company aiming to reduce critical cloud exposures by 90% within 90 days of deployment.
Stay Ahead in Cybersecurity!
Get the most critical cybersecurity news, insights, and strategies delivered to your inbox every week.
I will never spam or sell your information.
Rudder is an IT infrastructure automation platform that simplifies the management of hybrid infrastructure through configuration, patch, and security management.
CrossC2 is a tool used to generate CobaltStrike's cross-platform payloads, facilitating operations across different operating systems.
There are several tools that can be used in conjunction with Honeyd, for data analysis or for other purposes.
Before you go
If you found this newsletter useful, I'd really appreciate if you could forward it to your community and share your feedback below!
For more frequent cybersecurity leadership insights and tips, follow me on LinkedIn, BlueSky and Mastodon.
Best,
Nikoloz
