risk management

Cybersecurity & Vendor Risk in 2026

/ ,

In 2026, organizations face heightened cybersecurity risks due to reliance on external vendors, complicating security management. Critical vulnerabilities, often outside direct oversight, emerge as organizations depend on multiple vendors and sub-vendors. Attackers increasingly exploit these connections, amplified by AI, while regulatory demands for vendor oversight grow. CIOs must redefine trust by ensuring vendor security through continuous monitoring, clear contractual obligations, and governance. Effective vendor risk management is crucial for protecting revenue, operational continuity, and technology investments, positioning it as a key business performance driver.

https://nationalcioreview.com/articles-insights/information-security/cybersecurity-vendor-risk-in-2026/

How FOMO Is Turning AI Into a Cybersecurity Nightmare

/ , ,

AI implementation strategies often fail due to rushed deployment by executives overlooking operational risks, introducing potential costly cybersecurity issues. CEOs feel pressured by “Fear of Missing Out” amidst competitors adopting AI, resulting in inadequate risk assessment. Misunderstandings arise from AI vendors using ambiguous terminology, complicating security expectations and due diligence. Companies must not only assess risks but also implement thorough monitoring and control measures, including risk enumeration, blast-radius reduction, and robust alerting systems to ensure the security and functionality of AI tools.

https://www.inc.com/nick-selby/how-fomo-is-turning-ai-into-a-cybersecurity-nightmare/91261473

Council Post: Copy. Adapt. Secure.—How CISOs And Boards Can Learn From Everywhere

/ ,

Boards and CISOs are struggling to communicate cyber risk effectively. Instead of relying on more data and controls, CISOs should adopt proven risk management approaches from other industries, such as aviation, public health, and urban planning. By using these frameworks, CISOs can help boards understand cyber risk better and make informed decisions about security investments and strategies.

https://www.forbes.com/councils/forbestechcouncil/2025/12/29/copy-adapt-secure-how-cisos-and-boards-can-learn-from-everywhere/

“Threat Actors Have a Goal in Mind and They’ll Use Whatever Path They See to Get That Goal”

/ , ,

AWS CISO Amy Herzog discusses enhancing cybersecurity using AI, emphasizing specificity in AI roles and the need for realistic expectations about security effectiveness. She encourages businesses to focus on risk measurement and adaptability, rather than just scanning outputs. The new AWS security agent aims to proactively prevent issues, reinforcing that 100% security is unrealistic; instead, achieving a balance of functionality and control is key as threats evolve.

https://www.techradar.com/pro/security/threat-actors-have-a-goal-in-mind-and-theyll-use-whatever-path-they-see-to-get-that-goal-aws-ciso-tells-us-how-your-company-can-stay-safe-by-being-more-like-amazon

Dark Reading Research: The State of Application Security

/ , ,

Security professionals are increasingly concerned about attacks exploiting third-party software dependencies, particularly those using open-source code. The 2025 State of Application Security report highlights the growing risk of such attacks, with 56% of respondents believing their organizations are at greater risk than a year ago. The report also reveals challenges in securing applications, including the use of open-source code, container vulnerabilities, and a shortage of skilled application security practitioners.

https://www.darkreading.com/application-security/dark-reading-research-the-state-of-enterprise-application-security-2025

What Is DOD’s Cybersecurity Risk Management Construct?

/ ,

DOD initiates Cybersecurity Risk Management Construct (CSRMC) to enhance cybersecurity using dynamic, automated processes, replacing outdated static checklists. The phased approach promises proactive security management and emphasizes collaboration among cyber operators while enabling real-time defense against emerging threats.

https://fedtechmagazine.com/article/2025/12/what-dods-cybersecurity-risk-management-construct

How Much Risk Would a CISO Risk if a CISO Could Risk Risk? (LIVE in Boca Raton, FL)

/ ,

Key Points:

CISO role & business alignment: CISOs are often misunderstood and underpowered; success hinges on relationships and explaining cyber risk in revenue, operations, and trust terms.

Risk framing & CEO communication: CISOs must translate vulnerabilities into business impact, answer “Are we secure?” candidly but constructively, and help CEOs look informed and prepared.

Industry vs. business problems: Some issues (e.g., 2038 bug, protocol flaws) are industry-wide; they require collaboration through associations and better vendor listening, not just regulation.

Ethical trade-offs & incident response: In a Black Friday scenario, panelists debated whether brief downtime or ongoing limited data theft is worse; the audience favored avoiding deliberate data exfiltration.

Talent, AI, and community: AI is seen as augmenting staff, not replacing them; keeping up with regulation and recruiting talent relies on networks, counsel, culture, and continuous learning.

https://cisoseries.com/how-much-risk-would-a-ciso-risk-if-a-ciso-could-risk-risk-live-in-boca-raton-fl/

Ethical AI Governance in 2026: Best Practices for CISOs and the Middle Market

/ ,

CISOs in middle-market organizations must lead ethical AI adoption, balancing innovation and governance amid budget constraints. They face unique challenges, like algorithmic risks and compliance pressures, necessitating cost-effective frameworks and strategic partnerships. A roadmap for success includes assessing AI exposure, establishing robust policies, engaging leadership, and fostering a culture of collaboration, ensuring AI governance aligns with business values. By prioritizing ethical oversight, CISOs can drive innovation while building digital trust, setting the stage for sustainable growth in a rapidly evolving tech landscape.

https://www.rsm.global/latinamerica/en/insights/ethical-ai-governance-2026-best-practices-cisos-and-middle-market

How Much Cyber Risk Should a CISO Own?

/ , ,

CISOs' ownership of cyber risk is debated: while traditionally viewed as scapegoats, many argue they must assert responsibility. Discussions highlight the need for CISOs to align with business strategies and effectively communicate risk impacts to executives. Ultimately, risk is a shared responsibility across an organization, but CISOs should influence decisions and advocate for cybersecurity initiatives, despite potential limitations in authority. The role necessitates ongoing education of board members regarding cyber risks to enhance accountability and operational effectiveness.

https://cisoseries.com/how-much-cyber-risk-should-a-ciso-own/

When 30 Tbps Hits: What the Record-Breaking Aisuru DDoS Attack Reveals About Today’s Internet-Scale Threats

/ ,

Aisuru's DDoS Attack: Aisuru botnet executed a record 29.7 Tbps DDoS attack, demonstrating elevated attack capabilities exploiting vulnerable IoT devices. Its scale warns organizations of the rising threat posed by increasingly sophisticated threats. Even without direct targeting, businesses relying on cloud and APIs face risks. Effective security requires unified, AI-driven platforms for real-time detection and response across all layers. This incident underscores the urgency for improved defenses against large-scale cyber threats.

https://securityboulevard.com/2025/12/when-30-tbps-hits-what-the-record-breaking-aisuru-ddos-attack-reveals-about-todays-internet-scale-threats/

Scroll to Top