Tyler Shields

Insider risk resources are often scarce, and many large organizations, such as Google, tend to address these issues only after well-publicized incidents. -https://lnkd.in/gxyAny7a. Marshall Heilman and the folks from DTEX partnered with the Ponemon Institute to release the "Cost of Insider Risk 2026 Global Report" - https://ponemon.dtex.ai/. This report is the gold standard in providing trends to evaluate and budget for your own Insider Risk program. Share it with your chronically underappreciated Insider Risk folks Key Insights - Total average annual cost of insider security incidents is US$19.5M - Companies with an insider risk management program save themselves from 7 incidents a year, saving on average 8.2 million dollars - Time to Containment is reduced with a commitment to budgeting for Insider Risk, with an average of 67 DAYS to contain, down from 86 in 2023 - They address the rising COST OF SHADOW AI with cost of $10.3M due to negligent insiders

19

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

Today has been a day. If we aren't announcing yet another industry award (not so humble brag) we are announcing yet another notch on the belt establishing us as the leader in the identity security space. 🥇 Today we are excited to introduce two new capabilities: Identity Graph & Inventory and Access Intelligence. With these powerful additions to our Identity Security Platform, identity and security teams can: - Make every identity and its relationship across the entire hybrid environment visible - Quickly find hidden access paths and over-privileged accounts to get to least privilege faster - Stop threats before they spread by seeing where and how identities use the access they’ve been given This has been a long time coming with months of tireless effort from so many. Too many to write here but I need to capture a few: Revital Aronis (and team), Shai Keren ( 👑 ), Alicia diVittorio, Katharina Klein, Leonie Fraser, Tom Sadon, Alexa Gentry, Melanie Meyer Sommer, Aimee S., Jenya Raisfeld - but this was an absolute cross company effort with all hands on deck. Having a great product is a necessity. Having a great company with humans who truly care what we are building and deeply care about one another is a gift. 💖

73

3 Comments

Exploitation timelines are increasingly measured in days rather than weeks. Our latest report from Rapid7 Labs correlates vulnerability publication data, confirmed exploitation trends, frontline MDR incident response telemetry, and dark web, cybercrime, and nation-state intelligence to provide a unified view of how exposure evolves into compromise. One of the biggest standouts: how rapidly AI is being integrated into attacker playbooks, accelerating the operationalization of exposure. Many of the incidents we investigate still originate from known, unaddressed exposure. In those cases, attackers don’t need sophistication - they need opportunity. As remediation windows shrink, reducing that opportunity becomes essential to limiting compromise. You can download the 2026 Global Threat Landscape report here: https://r-7.co/4bQOAtq #infosec #cybersecurity

37

1 Comment

Check out Janet Costello Worthington's blog on this often overlooked, but extremely important requirement to understand what exactly you have just placed within your Enterprise.

6

1 Comment

C3PAO backlogs are stretching 3-9 months, with smaller assessors having the longest wait times. Matt Bruggeman, Director of GTM Federal at A-LIGN, explains that there are a limited number of certified CMMC assessors (CCAs and CCPs) in the entire ecosystem, and all C3PAOs are competing for the same pool of qualified personnel. A-LIGN invested heavily in building their assessor capacity specifically to maintain shorter backlogs as a competitive advantage. The timing reality means organizations waiting until they're "ready" to find a C3PAO are already too late. By the time they get in line, contract opportunities may pass them by. Watch the full interview here: https://lnkd.in/gXcV-KP7 Scott Price, CPA, CISA, CIA Steve Simmons Ryan Grace Taylor Mortti Jennifer Hawks, CISSP, CISM, PMP LaTara Allen, PMP, CISM, CISSP Blaise Wabo, CPA, CITP, CISA, CCP (CMMC), CCSK, CCSFP Michael Stebick John H. #DIBInnovators #defenseindustrialbase #SMBsintheDIB #cybersecurity #nationaldefense #defensetech #NIST800171 #CMMC #Compliance #DFARS

20

4 Comments

Cyberattacks are getting smarter. Are your defenses keeping up? AI can help you: * Spot threats in real time * Predict risks before they spread * Cut through alert noise * Respond faster * Meet compliance needs But tools alone aren’t enough. You need the right strategy. See how AI + expert guidance can improve your cybersecurity. Read the full post: https://hubs.la/Q03szv3J0 #Cybersecurity #AI #ArtificialIntelligence #Compliance

20

Thank you to this weeks newsletter and badge giveaway sponsor: Material Security! 👇 Sensitive data is often shared publicly and it’s a bigger problem than most realize. Material Security 's new report shows how organizations dramatically reduced the risk of exposing sensitive files with the right cloud security tools in place. Want to know how to better protect your Google Workspace? Check out the full insights here. https://lnkd.in/gQtfkrUb

41

One of the most actionable tips in Deepwatch’s new CISO 100 Days guide is simple but powerful: Executives don’t want dashboards. They want decisions. When reporting up: ✅ Translate alert tuning into reduced dwell time ✅ Tie detection improvements to uptime and customer trust ✅ Map telemetry to business systems, not log counts This is how security becomes a strategic function, not just a reactive one. 💡 Tip: Use “decision deltas” to anchor your board updates: What changed, why it mattered, and what action you took. #CISO

3

1 Comment

Jen Easterly, former director of CISA and now a strategic advisory board member for Huntress, is focusing on boosting cyber resilience for small and medium enterprises. These organizations often face sophisticated attacks but lack the resources to defend themselves. During her CISA tenure, Easterly championed initiatives such as the Joint Cyber Defense Collaborative and persistent threat hunting. These measures strengthened federal capabilities and deepened operational collaboration with the private sector, enabling rapid sharing of threat intelligence and faster mitigation of risks. In light of the shift from espionage to disruptive attacks on critical infrastructure, Easterly urges all organizations, regardless of size, to prioritize resilience - preparing for, responding to, and recovering from incidents - and to demand secure-by-design technology from vendors. "Every business, large and small, should consider themselves vulnerable. It's all about resilience. How do you understand the threat, prepare for it, be able to respond to it and then recover so that you can mitigate and drive down risk," she said. https://lnkd.in/gejpe3CB

4

NetRise is seeing a significant spike in work centered around the Cyber Resilience Act (CRA) where full compliance is required by December 11, 2027. We have developed automated analysis and reporting that takes the assessment workflows and reporting from days/weeks to minutes. We are leveraging AI in intelligent, domain specific ways to provide additional context and identify otherwise difficult to find issues with products and software. In one scenario, we helped a global device manufacturer save literal months by fully automating their process and then making the required edits for their specific workflows. This allowed for comprehensive coverage, and didn't force the organization to make trade offs for certain products. We have stood up a dedicated resource center on our website for all things CRA. On it, you will find: 1️⃣ Sample reports, these can be edited in an as needed basis 2️⃣ eBook that you can download giving an overview of the regulation, phased enforcement and cybersecurity requirements 3️⃣ NetRise & EU CRA Data Sheet outlining how the NetRise platform maps to the various CRA requirements If you are a software producer, device manufacturer or consulting shop working on CRA compliance, we would love to have an opportunity to show you how we can save your organization months of busy work. If you are a consulting shop, we can significantly increase the amount of engagements you can take on and provide you with a meaningful increase to your current margin profile. #sbom #cra #softwaresupplychainsecurity https://lnkd.in/gKrgKpvh

86

2 Comments