Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Announcing BitSight Executive Reports](/sites/default/files/styles/4_3_small/public/migration/images/10.10-Executive-Reporting-Thumb_1.png.webp?itok=cjL0XfbU)
An increasing number of security and risk management executives are being asked to present to the Board of Directors on the state of their — and their third parties’ — security and risk programs. A recent joint survey by Veracode and NYSE found that nearly 80% of directors said that cybersecurity topics are discussed at nearly every board meeting.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Ransomware is rapidly becoming one of the most common forms of malware distributed on systems all over the world.
![Making Vendor Risk Collaborative, Not Combative](/sites/default/files/styles/4_3_small/public/migration/images/Vendor-Access-Blog-Thumb_1.jpg.webp?itok=Zx5g1Mhj)
Reducing cyber risk that stems from third and fourth party vendors is no easy task. It requires that organizations not only have the ability to continuously monitor and identify new risk, but also the ability to work with their vendors to fix security issues quickly. Getting to risk reduction quickly means that both organizations are communicating effectively, using data and evidence rather than conjecture to make progress.
![Are Vendors Meeting Your Company’s Security Standards?](/sites/default/files/styles/4_3_small/public/migration/images/9.28-Insights-Blog-Thumb_2.png.webp?itok=52PXU3n1)
When it comes to vendor risk management, organizations ultimately need their vendors to meet the same standard of security performance they hold for their own organization. For years, the Finance industry has been a trailblazer in managing the risk posed by vendors, suppliers, and business partners. However, are vendors in the Finance supply chain meeting the same level of security performance held by Finance organizations?
![Six Key Areas of Focus for Your Cybersecurity Budget | BitSight](/sites/default/files/styles/4_3_small/public/migration/images/cybersecurity_spending_thumb_2.jpg.webp?itok=WE4o17B5)
The goal of cybersecurity is to help mitigate or prevent a cyber attack that could cause significant harm to your business, your operations, your financial performance, or your customers. But organizations with mature cybersecurity programs are increasingly aware of the fact that they cannot address every cyber threat since bad actors will continually find ways to hack and mine data. Instead, they choose to focus on preventing catastrophic attacks from taking place.
![Should You Underwrite A Company That’s Been Breached Before?](/sites/default/files/styles/4_3_small/public/migration/images/Thumb-Should-You-Underwrite-A-Company-Thats-Been-Breached-Before_1.jpg.webp?itok=K0NkBUdz)
In many lines of insurance, claim activity is part of the norm—and it’s expected that you’ll have to underwrite to losses consistently. For example, in casualty lines, it’s common to have workers file for worker’s compensation because of an injury they experienced on a job.
![Cybersecurity Reporting Best Practices](/sites/default/files/styles/4_3_small/public/migration/images/Thumb-cybersecurity-reporting_1.jpg.webp?itok=bX0ylPn_)
Today, businesses are at an interesting intersection when it comes to cybersecurity reporting: with modern technology, tons of data and thousands upon thousands of metrics are available to report on — but it’s difficult to determine which cybersecurity metrics actually matter. Because of this conundrum, many security and risk professionals feel a level of confusion around their security posture (and the security posture of their third party vendors). Does this sound familiar?
![Financial Services Cybersecurity: Third- & Fourth-Party Best Practices](/sites/default/files/styles/4_3_small/public/migration/images/Cybersecurity%2520In%2520Financial%2520Services%2520-%2520thumb_1.jpg.webp?itok=CJqK9P8T)
The financial services industry is known for its mature cybersecurity programs. There are many drivers for this, one being the increasingly strict regulatory environment. For example, the Office of the Comptroller of the Currency (OCC) indicated in early 2017 that financial service companies should be prepared for examiners to evaluate third-party cybersecurity.
![The Importance of Actionable Metrics in Managing Vendor Risk](/sites/default/files/styles/4_3_small/public/migration/images/9.1-Blog-Thumb_1.png.webp?itok=BAnrvrg5)
In today’s market, an increasing number of security and risk management executives are being asked to present to the Board of Directors on the state of their — and their third parties’ — security and risk programs. Gartner estimates that by 2020, 75% of Fortune Global 500 companies will treat vendor risk management as a board-level initiative to mitigate brand and reputation risk. Bitsight understands that making an organization’s cybersecurity posture accessible to C-level executives and the Board of Directors is becoming more of a requirement within the business; we’ve added capabilities within Bitsight Security Ratings that arm security and risk management executives with actionable metrics that they can share with the Board of Directors.
![Meet Our Engineers: Nick Whalen](/sites/default/files/styles/4_3_small/public/migration/images/EngineerDataScienceBlogFull_14.png.webp?itok=WGJamRF-)
Want to know what it’s like to be an engineer at Bitsight? Check out this Q&A with a member of our engineering team to learn about his role as Team Lead, his experience, and more.
![4 Cybersecurity Risks Healthcare Providers Face With Their Vendors](/sites/default/files/styles/4_3_small/public/migration/images/thumb-cybersecurity-in-healthcare_1.jpg.webp?itok=BHOfYJHB)
If you’re involved in a healthcare-based organization, you’ve likely noticed the push for stronger vendor security and vendor risk management (VRM) practices. There are a few reasons for this.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Security media is pervaded by seemingly ever-increasing and ever-worsening reports of data breaches at businesses ranging from your mom-and-pop corner store to large retail and internet giants. But how accurate is the perception that breaches are on the rise? Are more security events actually happening, or are we simply observing increased compliance with strengthening reporting requirements? More importantly, can companies learn from these incidents or are businesses doomed to repeat them?
![Why Loss Runs & Trends Alone Are Not Enough To Make Cyber Underwriting Decisions](/sites/default/files/styles/4_3_small/public/migration/images/Cyber%2520Underwriting%2520Decisions%2520-%2520thumb_1.jpg.webp?itok=zgal6r_T)
A loss trend can be defined as a projected loss expectation based on historical data. If you find that past losses might be indicative of potential future losses, you can then use this information to price your services accordingly.
![How Can Existing Vendor Risk Management Programs Efficiently Scale to Meet the Current Demand?](/sites/default/files/styles/4_3_small/public/migration/images/8.4-Blog-Thumb_1.png.webp?itok=Bei_cCsf)
In today’s world, organizations must be extremely conscientious about their vendors. It is just as important to be aware about the security of third-party networks as it is to be aware of their own. In April 2017, Netflix’s new season of the hit show “Orange is the New Black” was stolen and leaked after they ignored several ransom requests by a hacker. The agent was able to breach Larson Studios, a third party postproduction company for Netflix. It’s critical that organizations have a vendor risk management (VRM) program in place to address the risk posed by third parties. As outsourcing and the use of cloud services continues to grow, it’s even more crucial that the strategy can scale to meet the rising demands to increase the number of vendors. This is where many companies are falling short today.
![Meet Our Engineers: Nick Whalen](/sites/default/files/styles/4_3_small/public/migration/images/EngineerDataScienceBlogFull_14.png.webp?itok=WGJamRF-)
Want to know what it’s like to be an engineer at Bitsight? Check out this Q&A with a member of our engineering team to learn about his role as an engineering director, his experience, and more.