Eitan Worcel

One of the standout moments at OTCEP 2025 — Saltanat Mashirova session on OT Disaster Recovery. She brought a refreshing and much-needed perspective by anchoring recovery planning in engineering-centric scenarios — bridging the gap between cybersecurity, operations, and safety. A great reminder that in OT, resilience isn’t just about restoring data — it’s about restoring function, flow, and safety in the real world. #OTCEP2025 #OTCybersecurity #DisasterRecovery #OperationalResilience #EngineeringDrivenCyber #CriticalInfrastructure

107

6 Comments

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

Adversarial Exposure Validation is redefining how we understand risk. Explore why #NodeZero is leading the way in the 2025 Gartner® Market Guide.

1

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

A fun little entry where we can use network extension entitlements to flag remote access tools and VPNs. macOS entitlements are kinda slept on for detection and prevention. It's not a silver bullet, but it certainly gets you a lot of coverage and helps you identify new things you didn't know to look for without maintaining a list.

3

Yesterday, the OWASP GenAI Security Project released it's Top 10 for Agentic Applications, a focused list of the most severe security risks facing these self-governing systems. In a new blog post, Legit product manager Avishag Yulevich shares her perspectives on the new Top 10 and the relevance to AI coding agents. The blog also details additional risks to AI coding agents that Legit sees such as: * Generating vulnerable code * Sensitive data exposed by MCP extensions * Code exposed to 3rd parties * Hallucinated library injection Learn more in the blog - link is in the comments below. #AI #AIdevelopment #agenticapplications #OWASPTop10

5

1 Comment

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

Bodyguard or Risk Manager? The modern CISO has to be both, sometimes in the same meeting. In the latest episode of The CISO Signal Podcast, host Jeremy Ladner and guest co-host Oren Zenescu, CISO at Plarium, unpack the Okta support-system breach - when attackers turned everyday HAR files into keys for customer attacks. 🧩 This one hits where trust lives: inside identity and support workflows. From session tokens to support uploads, and the fine line between security operations and business enablement — this episode shows how easy it is for “help” to become the hacker’s backdoor. 🎧 Full episode in comments. #CyberCrime #CISO #IdentitySecurity #RiskManagement #TheCISOSignal #TrueCybercrime

4

1 Comment

For those of you navigating CRA & RED-DA compliance… this one’s worth a read. For many years product security compliance was treated like a checklist exercise something to rush through right before launch. CRA and RED-DA changed that. Today, compliance isn’t optional, and treating it as a one-off task is a recipe for delays, lost trust, and missed opportunities. My colleague David Nosibor shares how the PSCOPE Maturity Framework can flip the script turning regulatory compliance into a continuous operational capability that drives performance, scalability, and trust. Instead of chasing PDFs and scrambling for evidence, PSCOPE builds shared language, measurement, and maturity across governance, automation, supply chain, and monitoring. I strongly believe that this is exactly the kind of shift our ecosystem needs. https://lnkd.in/eBudy-wk #CyberSecurity #CRA #RED #Compliance #ProductSecurity #PSCOPE #ContinuousCompliance #CyberResilience #IoT #Regulations #CyberPass

20

1 Comment