Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![What Boards of Directors Are Missing about Cybersecurity](/sites/default/files/styles/4_3_small/public/migration/images/What_Boards_of_Directors_Are_Missing_about_Cybersecurity_1.jpeg.webp?itok=W9mThRcg)
Cyberattacks have increased significantly in recent years, bringing vital conversations about cybersecurity into the Boardroom. As Board oversight of cybersecurity has increased, Board members — even those without technical expertise — have had to become rapidly acquainted with IT risk and security concepts. In the past few years, frameworks and best practices have emerged to help these Boards get a grip on their organization’s cybersecurity posture.
![New Forrester Study Highlights Need for Security Performance Management](/sites/default/files/styles/4_3_small/public/migration/images/95%2520blog_1.jpg.webp?itok=GD2aZ1Qi)
In a new Forrester study commissioned by Bitsight, “Better Security And Business Outcomes With Security Performance Management”, key findings implicate the strong need for businesses worldwide to invest in a robust security performance management program. In fact, results from this study showed that companies using formal security metrics are more likely to have seen a 10% or greater increase in their security budget in the last year. Ultimately, this investment allows organizations to leverage this information to win business.
![As the Capital One Breach Proves, Effective CISO Leadership Starts with Culture](/sites/default/files/styles/4_3_small/public/migration/images/830%2520blog_1.jpg.webp?itok=aptyxvW3)
As the fallout from the Capital One data breach continues, new lessons are being learned. Although technical failings were at the heart of the breach, a recent article in the The Wall Street Journal points to a series of overlooked issues that produced perfect storm conditions for the attack.
![How Much Does a Data Breach Cost in 2019?](/sites/default/files/styles/4_3_small/public/migration/images/Calculating%2520The%2520Cost%2520Of%2520A%2520Data%2520Breach%2520Factors%2520You%2520Should%2520Keep%2520In%2520Mind%2520-%2520thumb_1.jpg.webp?itok=gGndBCHn)
This post was originally published October 31, 2016 and has been updated for accuracy and comprehensiveness
![Study: Hackers Look to Maximize Damage With New Ransomware Strategy](/sites/default/files/styles/4_3_small/public/migration/images/823%2520blog_1.jpg.webp?itok=D32EJSYX)
Cybersecurity threats are becoming more sophisticated, targeted, and potentially catastrophic. This is particularly true of the most dominant form of cyberattack – ransomware.
![SOC Stress: The Security Threat That Nobody is Talking About](/sites/default/files/styles/4_3_small/public/migration/images/816%2520blog%2520%25282%2529_1.jpg.webp?itok=XFR-IU5c)
Stress and burnout is emerging as perhaps the biggest threat to corporate security. Long hours, alert overload, and a lack of visibility into their IT infrastructure have many security professionals reconsidering their chosen careers.
![It’s Time for CISOs to Take a Seat at the Table](/sites/default/files/styles/4_3_small/public/migration/images/CISO%2520Seat%2520at%2520Table%2520-%2520FB%2520Social%2520Graphic%2520Main%2520Blog%2520Image_1.jpg.webp?itok=Z4UBIqNW)
It doesn’t matter what business you’re in — cybersecurity has become extremely important to both your organization’s reputation and its bottom line. According to reports, the average cost of a data breach is $3.86 million.
![Worthwhile TPRM Certifications for Security & Risk Professionals](/sites/default/files/styles/4_3_small/public/migration/images/AdobeStock_214874828-min_1.jpeg.webp?itok=e7WxrZna)
As the importance of third-party risk management (TPRM) continues to grow, organizations are hiring for related roles more seriously than ever before. To compensate, security and risk professionals are seeking out certification programs in TPRM to learn new skills and validate their expertise.
![Cloud Security: Lessons Learned from the Capital One Data Breach](/sites/default/files/styles/4_3_small/public/migration/images/89%2520blog%2520%25281%2529-1_1.jpg.webp?itok=aPBmCiJf)
2019 has already been rife with cybersecurity woes. Unfortunately, as we enter the second half of the year, things are going from bad to worse.
![State of BlueKeep Exposure & Insight Into Affected Systems](/sites/default/files/styles/4_3_small/public/migration/images/87%2520blog_1.jpg.webp?itok=XE_FBPUK)
In the weeks since our previous post, we’ve seen development in the security community withthe release of an exploit into a commercial product as well as the announcement of theunreleased integration of an exploit into Rapid7’s Metasploit framework. During this time, wewanted to provide an update of affected machines, but also dive a bit deeper into thecharacteristics of the individual systems that remain exposed and unpatched.
![CISOs Are Burning Out: Here’s How to Fix It](/sites/default/files/styles/4_3_small/public/2022/06/07/bigstock--218873089_1.jpg.webp?itok=NCBDnCoO)
Everyone experiences stress in their jobs, but security leaders may have it worse than most. According to Dark Reading, 60% of CISOs admit they rarely disconnect from work, while 88% work more than 40 hours per week. It’s no surprise that 51% of tech executives experience stress-related illnesses as a result of cyberattacks, tech outages, and breaches – a number that increases to 56% among CTOs and CIOs.
![Equifax Data Breach Settlement is a Warning Shot to Businesses Everywhere](/sites/default/files/styles/4_3_small/public/migration/images/726%2520blog%2520%25281%2529_1.jpg.webp?itok=8NzQC9hi)
The summer of 2019 is proving to be a cybersecurity record breaker – for all the wrong reasons. In the past two weeks, businesses in Europe and the U.S. were levied massive penalties after probes into data breaches that left consumer data exposed.
![Third-Party Insight into Triada & Related Families](/sites/default/files/styles/4_3_small/public/migration/images/717%2520Triada%2520Blog%2520Graphic_1.jpg.webp?itok=4crdrXqe)
A few weeks ago Google confirmed that there was malware pre-installed on a number of Android devices due to a supply-chain attack. The latest installment was discovered by security researchers from Dr.Web who have been investigating this situation for several years as it was already theorized by security researchers back in July 2017 that these infections originated as part of a supply-chain attack. In this instance, these devices were pre-installed with Triada, a form of Android malware that has been studied and reported on by Kaspersky and most recently Google in its attempt to surface this critical information to users and the wider community.
![GDPR Shows Its Teeth, Goes After Breached Companies](/sites/default/files/styles/4_3_small/public/migration/images/719%2520blog%2520%25284%2529_1.jpg.webp?itok=KUuVAVar)
In 2018, the European Union (EU) General Data Protection Regulation (GDPR) heralded in the most important change in data privacy regulation in 20 years.
![Industry Response to the BlueKeep Vulnerability](/sites/default/files/styles/4_3_small/public/migration/images/717%2520blog_1.jpg.webp?itok=OZJL8vo_)
It’s been five weeks since we first posted about the exposure of the BlueKeep vulnerability on the external networks of many organizations across the world. There have been further developments regarding the capabilities of the vulnerability including that both the DHS developed a working exploit and individuals from the private sector have also developed a remote code exploit. Both of these milestones further demonstrate the risk introduced by this vulnerability and the pressing statements by Microsoft and the NSA to patch.