Mythos is a signal, not a siren: What frontier AI should change for CISOs
That is why I view Mythos as a signal, not a siren. It signals that the economics of cyber offense and defense are changing. It…
Category: CISOOnline
Proposed US law would make AI risk reporting a legal obligation
The reporting requirement would also apply to theft or attempted theft of model weights, capabilities that could materially enable offensive cyber operations against important software…
Hackers exploit critical PTC Windchill PLM software flaw
Hackers are exploiting a critical vulnerability recently patched in PTC Windchill and FlexPLM, two product lifecycle management solutions used by organizations across a range of…
Malware authors subvert AI detection systems
Enterprises that have turned to AI in order to boost their security defenses may have to reconsider their approach. Malware containing code that commands LLM-assisted…
Cyberattacks pose a ‘threat to life’ in Australia
In this case, the hackers had gained access to login details and passwords for active users of the networks, including the IT professionals guarding it.…
What CISOs need to tell the board about zero trust in OT: A 90-day communication and action plan
Days 1–30: Map assets and identities at the IT/OT boundary The first 30 days are for increased visibility. I focus on a relatively simple question:…
GitHub Actions hardens checkout security to block ‘pwn request’ attacks
Blind spot If there’s a criticism that can be levelled at GitHub over this, it’s that it has taken so long to address a weakness…
AI-SPM buyer’s guide: 14 tools to secure your AI infrastructure
OneTrust AI Governance OneTrust offers AI Governance, a platform that automates compliance and provides continuous monitoring of the AI landscape, across the software lifecycle starting…
GRC is broken. FedRAMP 20x might fix it
No established playbook.No previous iteration.No deeply embedded understanding of how this model actually behaved in practice. At the same time, we weren’t trying to approach…
Rethinking the balance between AI oversight and innovation
The new CIO mandate is clear: facilitate AI adoption across the enterprise at speed. According to CIO.com’s State of the CIO survey, CEOs’ top priority…
Kahneman, ‘Where’s Waldo’ and the Nexus pass: A CISO’s mental model for the AI era
Security awareness training as a defense against phishing is dead. It has been dead for a while. The industry never held a funeral because the…
Be on the lookout for Mistic, a new backdoor used by ransomware broker
The backdoor itself reaches out to a command-and-control (C2) server and can execute code delivered from it directly in memory, without saving any file on…