How CISOs Can Use Identity to Advance Zero Trust

By / Blog /

CISOs must prioritize identity security to advance zero trust strategies amid rising identity-based cyberattacks. With breaches increasingly involving valid credentials, a shift from perimeter-based to identity-focused security is critical. Key controls include privilege management (least privilege, secrets management, just-in-time access), access management (adaptive authentication, SSO, MFA), and identity governance (visibility, compliance, automated reviews). Implementing these practices requires a structured roadmap to ensure they work harmoniously, enhancing resilience against evolving threats. The focus is on continuous identity verification for effective risk management.

https://www.csoonline.com/article/3951888/how-cisos-can-use-identity-to-advance-zero-trust.html

This Security Control Is So Good We Don’t Even Have to Turn It On (LIVE in Clearwater, FL)

By / Blog /

TLDR: Live podcast in Clearwater features David Spark, Christina Shannon, and Jim Bowie discussing effective security controls, training strategies, CISO challenges, and the impact of personal digital lives on work security. Topics include security awareness, engaging employees, dealing with high-pressure environments, and the importance of risk understanding in cybersecurity. Emphasis on continuous training, engagement, and management's role in supporting cybersecurity staff to reduce stress and burnout.

https://cisoseries.com/security-control-is-so-good-we-dont-even-have-to-turn-it-on/

CIO-CFO Tensions Jeopardize AI Success, Study Finds

By / Blog /

CIO-CFO relationships are crucial for AI success, but tensions pose risks. A KPMG survey reveals conflicting views on leadership roles and budgets affecting collaboration. While many executives recognize AI's importance, priorities differ, with CFOs often deeming innovation budgets excessive. Strengthening ties through clear roles, leveraging strengths, and joint ownership is vital for effective AI integration. Organizations must foster collaboration to fully harness AI's potential.

https://www.forbes.com/sites/noahbarsky/2025/04/01/we-or-me-choices-key-ai-rollouts-executive-survey-finds/

First Steps to Compliance: Meeting Early Obligations Under the EU AI Act

By / Blog / , ,

EU AI Act compliance begins February 2025, with early requirements like AI literacy and definitions of AI systems effective immediately. Organizations must educate personnel on AI risks and integrate literacy into governance frameworks. Key prohibitions include exploiting vulnerabilities and social scoring. Businesses should assess AI systems, ensure training, and stay updated on regulatory changes for compliance. Proactive approaches in governance may enhance trust and competitive positioning in the AI landscape.

https://kennedyslaw.com/en/thought-leadership/article/2025/first-steps-to-compliance-meeting-early-obligations-under-the-eu-ai-act/

Balancing AI Innovation and Regulation: Why the EU (Still) Needs a True Risk-Based Approach

By / Blog / , ,

EU AI Act needs risk-based approach: The EU should avoid a one-size-fits-all AI regulation, which risks stifling innovation due to overlapping enforcement and lack of risk/benefit analysis. A sector-specific approach is suggested to balance risks and benefits, streamline regulation, and enhance competitiveness, ensuring that future AI guidelines support innovation while safeguarding public interest.

https://project-disco.org/european-union/balancing-ai-innovation-and-regulation-a-risk-based-approach/

Phishing-as-a-Service (PhaaS)

By / P /

PhaaS: Cybercrime model offering phishing tools, infrastructure, and support for attackers. Lowers barrier to entry, enables widespread phishing campaigns. Users rent services, growth in cyber threats.

Navigating the Global Shift: How GDPR Is Reshaping Data Privacy for U.S. Businesses

By / Blog / , ,

GDPR, effective May 2018, reshapes data privacy globally, affecting U.S. businesses engaging with EU residents. It mandates strict data protection, enhancing transparency and customer control, thereby fostering trust. However, compliance poses challenges, especially for SMEs, due to regulatory complexity, resource constraints, and potential fines. Companies must implement robust data management and security, ensure user rights, and adjust operations to meet GDPR standards. Proactive compliance can enhance competitiveness and provide strategic advantages in a privacy-focused market.

https://techbullion.com/navigating-the-global-shift-how-gdpr-is-reshaping-data-privacy-for-u-s-businesses/

How CISOs Can Balance Business Continuity With Other Responsibilities

By / Blog / ,

CISOs face challenges in balancing business continuity with their security responsibilities, especially as cyber incidents evolve. Their role now includes overseeing risk management, ensuring quick recovery from cyber disruptions, and collaborating effectively with CIOs, who traditionally manage business continuity. A lack of clear ownership can complicate recovery efforts post-incident. Organizations increasingly prioritize cyber resilience and are adjusting budgets for business continuity programs. Effective strategies involve unified incident response, understanding business processes, and improving organizational maturity in continuity practices to prevent disruptions post-cyberattacks. Resilience planning requires a shift from conventional recovery to integrating robust security measures.

https://www.csoonline.com/article/3855823/how-cisos-can-balance-business-continuity-with-other-responsibilities.html

What Cybersecurity Guardrails Do CIOs and CISOs Want for AI?

By / Blog / ,

CIOs and CISOs Seek AI Cybersecurity Guardrails
As AI models proliferate, CIOs and CISOs aim to establish security measures to mitigate risks from unauthorized access, cyberattacks, and data leaks linked to AI deployment. Key questions include vetting AI for security, managing multiple models, and tracking unauthorized AI use within organizations.

https://www.informationweek.com/machine-learning-ai/what-cybersecurity-guardrails-do-cios-and-cisos-want-for-ai-

Understanding Key EU Cybersecurity Legislative Acts NIS2, CER, and CRA

By / Blog / , ,

EU enacts NIS2, CER, and CRA to enhance cybersecurity. NIS2 updates previous directives, imposing cybersecurity mandates on essential entities, effective January 2023. CER targets physical resilience in 11 sectors, starting January 2023. CRA mandates cybersecurity standards for digital products; effective December 2024, main provisions in December 2027. Non-compliance can lead to hefty fines. Businesses advised to comply with these regulations.

https://www.twobirds.com/en/insights/2025/understanding-key-eu-cybersecurity-legislative-acts-nis2,-cer,-and-cra

Scroll to Top