Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![5 Reasons To Uncover Third-Party Risk With Security Ratings](/sites/default/files/styles/4_3_small/public/migration/images/What%2520Is%2520A%2520Security%2520Rating_1.jpg.webp?itok=0DueNjVX)
Any seasoned vendor risk manager will tell you that determining whether a particular third party’s cybersecurity is up to your standards—and deciding how much risk to assume through your relations with your vendors—is not a simple task. Even so, there are technologies available that make handling vendor risk easier—and one of those is Bitsight Security Ratings.
![5 Best Practices for Conducting Cyber Security Assessments](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_631975841_2.jpg.webp?itok=ty2MaVd6)
Third parties are essential to helping your business grow and stay competitive. But if you’re not careful, your trusted partnerships can introduce unwanted cyber risk and overhead into your organization.
![cloud cyber security](/sites/default/files/styles/4_3_small/public/2021/11/14/shutterstock_1733556281.png.webp?itok=rsFQ2ZTe)
To protect your organization against cyber security risks, it’s important to have a cyber risk management program in place. But does your organization’s program take into consideration its entire attack surface – including the cloud?
![cyber insurance hygiene](/sites/default/files/styles/4_3_small/public/2023/06/28/Cyber%20Insurance%20Underwriting%201%2C%20SIZED.jpeg.webp?itok=JOdsKVLM)
How do cyber insurers determine which organizations are going to be a risk worth taking? It’s more important than ever to continue underwriting good and opportunistic risks, while not overcorrecting for the high loss ratios the industry is seeing. Insureds need to answer two questions: what is good cyber hygiene and how do you measure it?
![How to Set a Cybersecurity Baseline for Your Vendors – and Hold Them to It](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_568128427.png.webp?itok=fFCFBqId)
Your supply chain is more critical now than ever. Vendors and third parties are essential to helping your organization scale to meet demand, gain access to greater resources, respond to new work models, and remain competitive.
![What Your Board Does (& Doesn't) Need To Know About Cybersecurity](/sites/default/files/styles/4_3_small/public/migration/images/cybersecurity%2520board%2520of%2520directors%2520-%2520thumb_1.jpg.webp?itok=eko9eUZF)
Special thanks to Venky Ganesan, the managing director of Menlo Ventures, for his insights into this topic.
![MOVEit Transfer vulnerability-Bitsight research findings](/sites/default/files/styles/4_3_small/public/2023/07/18/MOVEit%20Transfer%20vulnerability-Bitsight%20research%20findings.jpg.webp?itok=TUtYrcl5)
Discover the methodology, at a technical level, the Bitsight Security Research team used to evaluate the three critical vulnerabilities affecting MOVEit Transfer.
![What To Include In Your Cybersecurity Board Of Directors Presentation](/sites/default/files/styles/4_3_small/public/migration/images/Thumb_-_What_To_Include_In_Your_Cybersecurity_Board_Of_Directors_Presentation_1.jpg.webp?itok=EQUegT9q)
Most Boards today know that cybersecurity is a critical issue that simply cannot be overlooked — which means many Boards today receive regular briefings on the topic. If you’re a new CIO or CISO (or your organization has just begun this practice) it’s absolutely critical that you establish credibility when you present to your Board of Directors. If you’ve been asked to present and you’ve never briefed a Board of Directors on cybersecurity before, your questions are going to be far different than they would be if you had seven or eight presentations under your belt. So below, we’ve detailed some of the topics you should include in your cybersecurity Board of Directors presentations — for both first timers and seasoned presenters.
![4 Ways to Improve Cybersecurity Collaboration Between Security Teams and the C-Suite](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_748719808.png.webp?itok=6ol21rwz)
Recent events have made cybersecurity a top concern among C-suite executives. The SolarWinds breach, Capital One incident, and Colonial Pipeline attack are just a few of the noteworthy events that have made CEOs and CFOs take active roles in discussions around risk mitigation.
![Cybersecurity for Executives: How to Talk to Leaders About the Importance of Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1727882452.png.webp?itok=SLe-gVmT)
The red lights are flashing everywhere. News stories are warning about a sharp rise in ransomware attacks, a 2000X fold increase in cybersecurity breaches, and more cyber-related doomsday scenarios. Meanwhile, the Biden Administration released a much-anticipated cybersecurity plan earlier this year, calling for more investments in cybersecurity.
![cyber risk management unified approach](/sites/default/files/styles/4_3_small/public/2023/10/02/cyber%20risk%20management%20unified%20approach.jpeg.webp?itok=F6aU8CTB)
Discover how consolidating your cybersecurity efforts not only saves costs but also enhances your organization's security posture—and that of your vendor ecosystem.
![Using BitSight Security Ratings to Foster Close Vendor Relationships](/sites/default/files/styles/4_3_small/public/migration/images/12.1-Blog-Full_1.png.webp?itok=N6Am_MfY)
In today’s business landscape, it’s critical to manage the risk that your vendors, or third parties, can pose to your business — and it’s not always the easiest task. It requires that organizations not only have the ability to continuously monitor and identify new risk, but also the ability to work with their vendors to fix security issues quickly. Getting to risk reduction rapidly means that both organizations are communicating effectively, using data and evidence rather than conjecture to make progress.
![BitSight + Glass Lewis](/sites/default/files/styles/4_3_small/public/2023/09/13/Bitsight-and-Glass-Lewis.png.webp?itok=I-6CfQr9)
In 2023, the SEC adopted new cybersecurity disclosure requirements. Learn how shareholders can leverage cybersecurity information for investment decisions and more.
![Using Security Ratings & the NIST Framework for Cybersecurity Maturity](/sites/default/files/styles/4_3_small/public/migration/images/NIST-blog_post_large_4.jpg.webp?itok=x30Jnf4H)
On February 12, 2013, President Barack Obama issued Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” which called for collaboration between government and the private sector to create a set of standards for organizations to identify, assess, and manage cybersecurity risk. This led to the NIST Cybersecurity Framework (CSF), a way for organizations to manage cybersecurity risk without the need for additional regulatory requirements. According to the Trends in Security Framework Adoption Survey earlier this year by Tenable Network Security, nearly a third of the organizations they surveyed leverage the NIST Cybersecurity Framework, with many respondents viewing it as an industry best practice.
![5 vendor evaluation tools to add to your cyber risk management toolkit](/sites/default/files/styles/4_3_small/public/2021/12/10/5%20vendor%20evaluation%20tools%20to%20add%20to%20your%20cyber%20risk%20management%20toolkit.png.webp?itok=5jgMMpvG)
Five of the most critical vendor evaluation tools that you should have in your cybersecurity risk management toolkit.