OpenAI rolls out AI-led push to fix open-source software flaws
“CISOs should demand a Safety Relevance Layer in their risk modeling, a structured framework that requires every AI-generated finding to pass automated verification, including dynamic…
Category: CISOOnline
Cybersecurity is no longer about protection. It’s about survival.
That is the contradiction at the heart of modern cybersecurity strategy. We say, “Assume the breach,” but we budget, govern, architect, and rehearse as if…
Change your cyber risk strategy to meet AI threats, Five Eyes countries warn CSOs
Ilia Kolochenko, CEO of ImmuniWeb and adjunct professor of cybersecurity practice and cyber law at US-based Capitol Technology University, said the Five Eyes statement “makes…
Klue breach exposed Salesforce CRM data through stolen OAuth tokens
Security vendor and Klue customer Huntress published its own investigation filling in that gap. The attackers had pushed a code update to a Klue integration…
AWS Continuum offers devs help with securing code
“The harder problem is no longer just finding issues, it is knowing which ones are real, which ones matter in their environment, and which ones…
Anatomy of a retail ransomware attack: Tabletop simulates modern mayhem methods
Like many tabletop exercises, this particular simulation was designed to get participants to think outside the box, improve cross-team communications, and develop improved incident response…
6 security leader tips for mastering business risk
“CISOs need to provide input and remediation on the impact of security cost because these often-hidden costs have a negative impact on profitability,” he says.…
Cybersecurity was built for predictable systems. AI changes the rules
Every major technology shift changes cybersecurity. I’ve spent much of my career working through major technology transitions, from the rise of the commercial internet to…
5 new security operations roles the AI-SOC will create
As of today, AI-SOC capabilities center on autonomous alert triage and basic investigations. When something looks awry — a suspicious login, an EDR alert, etc.…
Microsoft says web-enabled AI agents can trigger host-level RCE
The first involved an origin allowlist designed to accept connections only from localhost. Under normal conditions, this protection would block a browser visiting a malicious…
Security considerations for adopting Claude Code and Cowork for SMBs
You are a security leader at a small or medium-sized business (SMB), and your organization has decided to adopt Claude. If you are like me,…
Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform
The principle behind BYOVD is simple enough: once an attacker has gained admin privileges through an account takeover, they load a legitimate, but old and…