Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Quantifying Cybersecurity Risk: A Beginners Guide](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Asian-Business-Adviser-Meeting-226416148_1.jpg.webp?itok=Qb25yCDA)
In a 2017 survey of almost 1,300 CEOs conducted by PwC, 63% of respondents said they were “extremely concerned” about cyber threats — up from just 8% in 2013.
![5 Reasons Not To Miss BitSight’s Inaugural EXCHANGE Event](/sites/default/files/styles/4_3_small/public/migration/images/18-BITS-1000-Linkedin-1200x627-Tier2-2_1.jpg.webp?itok=Lx2JYOG3)
On October 9th & 10th, Bitsight will host EXCHANGE, the premier event for security and risk professionals, at the Intercontinental New York Times Square. Over the course of this one-day event, distinguished business and technology leaders will discuss the current and evolving state of cybersecurity, best practices for addressing cyber threats, and how to both prioritize and focus risk management efforts within an organization.
![Fact or Fiction (Part 2): More Misconceptions About Third-Party Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/7.16-Blog-Fact-Fiction-TPRM_9.jpg.webp?itok=lGWyVvjZ)
Over the course of this blog series, we’ve addressed some of the major concepts surrounding third-party risk, as well as addressed some misconceptions. In this final post, we’ll continue to examine the last three of the top notions surrounding third-party risk management programs and weed out fact from fiction.
![Cybersecurity Metrics Your CIO Expects You to Know](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Business-Finance-Accounting--237523486_1.jpg.webp?itok=Cfl9ezfF)
In today’s landscape, managing your internal security processes as well as creating a third-party vendor risk management program should be top of mind, but prioritizing a solid understanding of the metrics surrounding your cybersecurity programs almost just as important. These metrics should dive deeper than “yes” or “no” questionnaire answers, but should help you gain a more comprehensive understanding of where you and your third parties fall when it comes to proactively mitigating cyber risk.
![Fact or Fiction (Part 2): More Misconceptions About Third-Party Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/7.16-Blog-Fact-Fiction-TPRM_9.jpg.webp?itok=lGWyVvjZ)
There are many third-party risk concepts, some of which we addressed in the first blog post of this series. While third-party risk management (TPRM) programs are becoming increasingly common for businesses, there are still some misconceptions about the elements that comprise them. In the second post of our three-part blog series, we’ll take a look at some of the notions surrounding third-party risk management programs and weed out fact from fiction.
![A Forward-Looking View Into Security Performance](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--195359497_1.jpg.webp?itok=SJHgxD5p)
For the last five years, Bitsight Security Ratings have been helping companies gain insight into the efficacy of their security programs, as well as the security performance of third and fourth party vendors. Today, the Bitsight Security Rating platform provides a year’s worth of data on all companies to paint a comprehensive picture of a company’s security posture over time.
![Optimizing Our Test Infrastructure](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Programmer-Hands-Working-At-Ho-252378223_1.jpg.webp?itok=RRHn_GIo)
Bitsight is moving fast, but we don’t want to sacrifice code quality for speed, which is why tests have always played an important role in our development process. Although we are not doing TDD (Test-driven development), one of the key requirements for doing test heavy development is that the full test suite should be fast. If running all tests takes less than 5 minutes, developers are more likely to run them frequently and keep adding more tests. However, Bitsight's portal application is a bit of a monolith and takes longer than we would like to run test suites.
![Fact or Fiction (Part 2): More Misconceptions About Third-Party Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/7.16-Blog-Fact-Fiction-TPRM_9.jpg.webp?itok=lGWyVvjZ)
It’s no secret that while it is critical for an organization to have a strong cybersecurity posture, it’s just as important for their third parties to have a strong security posture as well. While this fact is becoming increasingly more acknowledged in the business world (as many companies suffer data breaches at the hands of their suppliers), there are still several misconceptions about third-party risk management (TPRM) programs and what they entail. Among the many initiatives that make up a modern enterprise cybersecurity program, TPRM might be the most misunderstood.
![BitSight Offers Valuable Insight Into Breach Trends](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Fintech-Icon-On-Abstract-Fina-226174948_2.jpg.webp?itok=Irj15Jpw)
Over the last several months, members of our product team have been working to aggregate all of Bitsight’s security ratings data and highlight important insights about patterns in data breaches. In fact, Bitsight boasts one of the largest data breach data sets. Of course, this only highlights what data Bitsight has visibility into; with the largest sinkholing infrastructure in the world and the security posture of over 130,000 organizations, we have the most comprehensive view into global breach trends.
![What Now? How to Execute the Cybersecurity Plan You Have in Place](/sites/default/files/styles/4_3_small/public/migration/images/What_Now_How_to_Execute_the_Cybersecurity_Plan_You_Have_in%2520Place_1.jpg.webp?itok=6QCpJ3ia)
CISOs and other security leaders are tasked with protecting their organizations from cyber attacks. That means developing and implementing the policies, controls, and procedures that reduce risk and ensure the safety of sensitive data. It also means keeping the cybersecurity program alive and well-funded.In other words, security leaders are fighting on two fronts. When executing a cybersecurity plan, they must employ two distinct yet equally important skill sets: the technical skills to mitigate risk, and the strategic skills to make the case for cybersecurity to their colleagues. Striking a balance between these two categories is tricky. We’ve got some tips for CISOs and other security leaders looking to execute their cybersecurity plans effectively and achieve sustainable results.
![Ticketmaster Breach Highlights Retailers' Dependence on Multitude of Service Providers](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-credit-card-data-security-83131502_1.jpg.webp?itok=j8E4oMdf)
Early last month, it was disclosed that Ticketmaster suffered a data breach through a third party service provider as part of a payment card hacking campaign; Ticketmaster was just one of hundreds of victims. The threat actor, Magecart, compromised over 800 e-commerce sites by secretly installing digital card-skimming software on third-party components and services used by these retailers.
![Which Cybersecurity Tasks Should I Prioritize First? Tips from the Experts](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--177323620_1.jpg.webp?itok=J-XFiRw4)
Cybersecurity is a multifaceted topic with many constantly evolving variables. For CISOs and other security leaders, just knowing where to begin can be a challenge.Let’s say you’ve just taken over an organization’s cybersecurity program, or have been tasked with building one from scratch. You have a limited budget and limited personnel, so you can’t accomplish everything at once. Which tasks deserve your focus in the critical first few months? We’ve rounded up some cybersecurity tips from industry experts to help guide your initial strategy.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
[updated January 10, 2021]
![How Continuous Vendor Monitoring Can Prevent Service Interruptions](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--160637267_1.jpg.webp?itok=x2-ojTBt)
On a Friday morning in October 2016, millions of people across North America attempted to visit popular websites including Spotify, Reddit, and the New York Times, only to find that they were inaccessible.
![BitSight Competes in Annual Boston Children's Hospital Corporate Cup](/sites/default/files/styles/4_3_small/public/migration/images/display_AAA983__IMG_9981-966957-edited_1.jpg.webp?itok=AovYjX0F)
On July 12th, eighteen Bitsight employees participated in the Boston Children’s Hospital Corporate Cup. This is an annual event where local Boston companies from across all sectors compete against each other for a good cause: raising one million dollars for the children at Boston Children’s Hospital.