CISO InsightsLatest insight
A Quiet Alert Queue Can Hide a Broken Signal
Review source health, coverage, and authorized detection tests to understand the confidence behind a quiet alert queue.
5 min read · November 5, 2026
Real-World Cyber Insights
No vendor fluff. No recycled frameworks. Just honest, experience-driven perspectives on what actually matters in cybersecurity today.
39 articles
Identity Security
When an App Gets Access to Your Email, Who Can Remove It?
Review OAuth application access before an incident: identify permissions, assign removal authority, and test how to revoke access safely.
5 min read · October 29, 2026
Cyber Risk Management
Cyber Risk Acceptance: Give Security Exceptions an Expiration Date
A practical guide to cyber risk acceptance: assign security exception owners, document safeguards, set expiration dates, and review residual risk.
6 min read · October 26, 2026
AI Security
Before an AI Agent Goes Into Production, Test What It Must Refuse
A practical refusal test for AI agents: verify identity, enforce permissions, bind approvals to specific actions, and check evidence beyond the chat.
6 min read · October 22, 2026
Identity Security
What Could a Compromised Account Reach? Lessons from the DTU Breach
The review I would bring to management after the DTU breach: what an account can reach, what its activity records, and which personal data the business still needs.
5 min read · October 6, 2026
Third-Party Risk
Who Funds Your Suppliers? A CISO's View of MI5's CGTRI Warning
What MI5 reported about CGTRI, and the supplier review I would bring to management: ownership, funding, access, and a clear decision on what to do next.
5 min read · October 4, 2026
Compliance
Cisco SD-WAN Manager Zero-Day: Management Plane Compromise Under Active Exploitation
CVE-2026-76504 (CVSS 9.8) lets any attacker bypass authentication with a single percent-encoded character in the login path and take full admin control over every device in the SD-WAN fabric. No credentials required. Discovered after a customer was already compromised. The fourth critical SD-WAN CVE in 2026.
8 min read · September 30, 2026
Threat Intelligence
543,000 Working Credentials in Public GitHub Repos: Why Detection Is Not Enough
Truffle Security scanned 224 million repos and found 543,699 valid credentials still active. Median exposure time: 784 days. One npm token out of 101,886 was still valid (automated revocation). 69,041 out of 126,963 Google Cloud accounts were still valid (manual process). The difference is revocation automation, not scanning.
8 min read · September 30, 2026
Threat Intelligence
Hundreds of AI Agents. 440 Compromised Instances. The PaperCut Attack Redefines Exploitation Speed.
A Russian-speaking actor deployed hundreds of AI agents to mass-exploit two chained PaperCut vulnerabilities across 440+ internet-facing instances in 10 countries. The vulnerability class is not new. The operational speed is. If your patch window is measured in weeks, you are losing the race.
9 min read · September 9, 2026
Compliance
CISA Just Set a September 12 Patch Deadline. Your Cisco, Citrix, or Fortinet Device May Be on the List.
CISA added three critical actively exploited vulnerabilities to its KEV catalog — including a CVSS 10.0 Cisco Secure Firewall Management Center auth bypass. Federal agencies have until September 12. Here is what every organization running these products needs to know about aligning patch management with exploitation reality.
8 min read · September 8, 2026
Threat Intelligence
Aurora Ransomware Used an AI Coding Assistant to Plan Your Breach
The Aurora ransomware group used Cursor AI to plan attacks against 33 victims across the US and Europe — including a full AD CS exploitation plan written in Russian. The same tool your developers use. The detection implications are significant.
9 min read · September 2, 2026
Compliance
China's Fire Ant Is Inside Your Routers. CIRCIA Requires You to Report It Within 72 Hours.
A China-linked espionage group compromised Cisco IOS XR routers, suppressed logging, and scanned critical infrastructure. CIRCIA's 72-hour clock starts when you become aware — but Fire Ant targeted the tools that create awareness.
8 min read · September 1, 2026
Threat Intelligence
ShieldBreak: The Public Exploit That Turns Microsoft Defender Into an Attack Path
A researcher published a working proof-of-concept exploit for Microsoft Defender on August 12. Any standard user can gain SYSTEM privileges using Defender's own scheduled tasks. No patch exists. Here is what CISOs need to detect now.
7 min read · August 27, 2026
Compliance
96% vs. 29%: The CMMC Compliance Gap Exposing Defense Contractors to False Claims Act Liability
Two surveys published in August 2026 reveal that 96% of US defense contractors claim CMMC compliance, but only 29% can demonstrate it. The Pentagon suspended Phase 2 assessments. DFARS attestation obligations and False Claims Act liability did not pause.
7 min read · August 26, 2026
Threat Intelligence
AmnesiaStealer: The macOS Malware That Gives Attackers Your Authenticated Sessions, Not Just Your Passwords
AmnesiaStealer copies your Chromium browser profile into a hidden headless browser and gives attackers live 3fps remote control over your authenticated sessions. MFA is already cleared. Here is what enterprise security teams need to know.
8 min read · August 20, 2026
Compliance
€30 Million in Four Days: What the Commerzbank Service Provider Breach Means for DORA Third-Party ICT Risk
Attackers exploited a faulty software update at a payment processor to steal €30 million from Commerzbank accounts. Seven suspects arrested in August 2026. DORA, in force since January 2025, was built to address exactly this third-party ICT risk pattern.
8 min read · August 19, 2026
Threat Intelligence
800 Malicious npm Packages. Your SCA Tool Probably Missed Them.
Nearly 800 malicious npm packages flooded the registry using AI-generated typosquatting names. The WEL1DROPPER campaign delivers a cross-platform RAT on Windows and Mac, and Sliver C2 on Linux. Standard SCA tools miss this because the packages had no prior malicious history.
8 min read · August 12, 2026
Compliance
255 Days. HIPAA Allows 60. What the Unlimited Technology Breach Reveals About Notification Readiness.
Unlimited Technology Systems took 255 days to notify HHS after detecting a breach affecting 3.8 million people across 4,500 clinics. HIPAA requires 60. The gap reveals a systemic readiness problem for healthcare software vendors.
8 min read · August 11, 2026
Compliance
Levi's Filed an 8-K in Four Days. Most Public Companies Are Not Ready to Do That.
Levi Strauss disclosed a corporate data breach to the SEC within four business days after social engineering hit three employees. The harder question is how organizations make a defensible materiality determination under incomplete forensics and legal pressure.
8 min read · August 11, 2026
Cloud Security
Google Passkeys Can Be Hijacked. Not the Cryptography. The Cloud Sync.
Unit 42 published three attacks, called Pass-ta-key, that allow unprivileged malware to hijack Google Password Manager's cloud-synced passkeys in Chrome. No admin rights. No user interaction. The passkey cryptography is not broken. The cloud sync trust model is.
9 min read · August 5, 2026
Compliance
Your Hotel Is PCI-DSS Certified. APT29 Targeted It Anyway.
Microsoft confirmed APT29 (Midnight Blizzard) has been running CaptiveCrunch, a global campaign targeting hotel and conference Wi-Fi since May 2026. The attack steals M365 session tokens through compromised captive portal hardware. PCI-DSS certification did not stop it.
9 min read · August 4, 2026
Penetration Testing
CVE-2026-16723: The Fastjson Zero-Day Your Pen Test Probably Missed
Fastjson 1.x has a CVSS 9.0 RCE with no patch and active exploitation in financial services. A vulnerability scanner would not have caught it. A properly scoped penetration test would have.
9 min read · July 30, 2026
Compliance
DORA Didn't Account for an AI Agent Running in YOLO Mode
An open-source AI agent breached Thailand's Finance Ministry this week in fully autonomous mode. No human in the loop. Here is what that means for DORA ICT risk management and financial sector detection capabilities.
9 min read · July 29, 2026
Threat Intelligence
Half a Billion WordPress Sites. Zero Credentials Required. Found by Continuous Monitoring.
CVE-2026-63030 and CVE-2026-60137 chain to give any anonymous user remote code execution on WordPress 6.9 and 7.0. A public proof-of-concept is on GitHub. The attack surface management team that found it wasn't running a pen test.
8 min read · July 23, 2026
Compliance
The OpenSSL Fix That Arrived with No CVE. NIS2 Still Expects You to Patch It.
OpenSSL shipped a fix on June 9 with no CVE, no advisory, and no changelog entry. Okta's Red Team published the details 38 days later. NIS2 and DORA require patch management for known vulnerabilities. This one was deliberately invisible.
8 min read · July 22, 2026
Compliance
EU AI Act: Your CISO Checklist for August 2
On August 2, 2026, EU AI Act high-risk obligations become enforceable. Fines reach 35M EUR or 7% of global revenue. 78% of organizations are not ready. Here is the 5-step CISO action plan.
8 min read · July 15, 2026
AI Security
Your CFO Is on the Call. So Are Three Executives. None of Them Are Real.
A finance employee at Arup wired $25.6M after a deepfake video call with fake executives. The controls worked exactly as designed. The threat had already moved past them.
10 min read · July 10, 2026
AI Security
AI Governance Without Board Accountability Is Just a Document
The EU AI Act starts enforcing high-risk AI system rules on August 2, 2026. Most boards don't know which of their AI systems qualify. That is the governance gap nobody is talking about.
9 min read · July 3, 2026
AI Security
Shadow AI: The Insider Threat Your Security Stack Can't See
Employees are pasting sensitive data into unapproved AI tools every day. This is not a future risk - it is a data breach unfolding in slow motion, and most organizations have no visibility into it.
9 min read · June 27, 2026
AI Security
AI Is Already Being Used Against You. Here's How to Fight Back.
Deepfake video calls, AI-cloned executive voices, autonomous phishing agents - attackers are already using AI at scale. Here is the security framework every organization needs before AI becomes a liability.
10 min read · June 26, 2026
Threat Intelligence
Signed, Trusted, Compromised: The npm Supply Chain Attack That Fooled Every Security Gate
The Shai Hulud campaign poisoned 373–416 npm package versions - all signed, all attested, all verified. What CISOs must understand about software supply chain trust when 'signed' no longer means 'safe'.
9 min read · May 16, 2026
Threat Intelligence
CVSS 9.8: How a cPanel Auth Bypass Became a Mass Ransomware Campaign
CVE-2026-41940 gives attackers admin access to cPanel servers with no credentials required. It was exploited before the patch shipped. Here is what that means for your exposure.
8 min read · May 6, 2026
Threat Intelligence
Your Collaboration Tools Are Now the Attack Surface
MuddyWater used Microsoft Teams to steal credentials and deploy false-flag ransomware. If your attack surface map does not include Teams, Slack, and Zoom, you have a blind spot.
8 min read · May 6, 2026
Threat Intelligence
When Your Security Vendor Gets Breached: Third-Party Risk in the Security Stack
Trellix confirmed attackers accessed their source code repository. If your security vendor can be breached, how much scrutiny are you applying to the tools that sit inside your environment?
8 min read · May 3, 2026
Compliance
AI Compliance Theater: Your GRC Platform Got a Chatbot. Your Team Still Chases Evidence.
Security leaders spend 40% of their time on compliance admin. The GRC industry's answer was a chatbot on top of a 2019 dashboard. That is not AI. Here is what autonomous compliance actually looks like.
9 min read · April 26, 2026
Threat Intelligence
The $415M Wake-Up Call: Why Your AI Threat Model Is Outdated
One attacker. Nine Mexican government agencies. 415M records exfiltrated using Claude Code and GPT-4.1. What CISOs and boards must change this quarter.
10 min read · April 23, 2026
Threat Intelligence
The Three Doors Ransomware Crews Walk Through
Frost Bank and Citizens Bank both lost data to Everest ransomware in the same week. No zero-days - just three doors every CISO can lock this week.
10 min read · April 22, 2026
Threat Intelligence
Why Most Companies Don't Know They've Been Breached
The average company takes 194 days to detect a breach and 64 more to contain it. Here's why detection fails - and what CISOs can do to change it.
9 min read · April 20, 2026
CISO Insights
The CISO's Guide to Board Communication
Boards don't speak 'cyber.' They speak risk, cost, and reputation. Learn how to translate your security program into language that drives action.
8 min read · April 19, 2026
No articles match your search. Try another keyword or choose all topics.
Continue the conversation on LinkedIn
Join the conversation on LinkedIn - where I post daily insights on cybersecurity, risk management, and the CISO mindset.
Follow on LinkedIn