Industry News

Discover why Governance, Risk, and Compliance (GRC) programs, even with strong foundations and executive support, often face challenges when key control owners leave an organization.

Understand CISA's urgent warning—and the steps to take now to prevent a critical infrastructure compromise.

Agentic AI magnifies intent drift in controls. Learn the 3-question Intent Check to curb risk, noise, and compliance gaps.

Explore how nondeterministic AI applications differ from traditional IT systems, producing varying outputs even with the same input, and the implications for securing AI models.

Explore how AI disrupts zero trust architecture and gain strategies to secure expanding machine identities and automated decisions amidst evolving technologies.

Learn about privacy risk management strategies to ensure compliance, protect personal data, and build trust.

Discover how to navigate the digital frontier with cutting-edge governance strategies for digital proxies in spatial computing. Uncover insights into audit trails, identity verification, and risk management to secure virtual environments effectively.

Explore modern third-party risk management with contextual assurance, continuous monitoring, and AI for improved decision making and resilience.

Artificial intelligence (AI) automation and ransomware as a service (RaaS) platforms have fundamentally altered the threat landscape by lowering the capability bar of entry and enabling nation-state actors to automate up to 90% of intrusions.

Discover AI's true environmental impact. Learn how AI technology influences water use, debunk myths, and compare differing viewpoints for a clearer picture.

Explore how Claude Mythos is reshaping cybersecurity with AI-driven threat detection, raising new challenges for defenders.

Microsoft Defender has become the default endpoint protection for enterprises, but a control-oriented approach is needed to ensure its configurations are enforceable and measurable.

Explore the vital role of rapidly evolving IT frameworks like IAM, IGA, and PAM in securing user identities and managing access within organizations. Discover how these foundational pillars enhance security and compliance.

Australia's SMMA legislation shifts accountability from parents to platforms, enforcing age verification to protect children online while navigating technical, privacy, and social challenges.

For organizations, this evolution offers both promise and peril. On one hand, these autonomous teams can work independently to discover complex attack paths and respond rapidly to threats, reducing a significant amount of manual workload.

There are 5 key ways auditors can shape the cybersecurity perspective of senior leaders in organizations across sectors.

Despite unprecedented advances in technology, phishing remains one of the most persistent cybersecurity threats organizations face.

Translating technical data into meaningful business metrics requires more than rewording—it involves quantification, context, and correlation.

Passwordless authentication promises enhanced security, streamlined user experiences, and reduced operational costs.

AI is embedded in virtually everything cyberprofessionals do, both offensive and defensive, and it is reshaping how leaders think about security strategy and risk management.

Establishing governance frameworks that prioritize risk mitigation and system security ensures that AI is not only harnessed effectively but also ethically.

Organizations must act now to address the complexity of this technology, recognizing that agentic AI presents not only technical and compute challenges but also profound identity and policy dilemmas.

With upcoming artificial intelligence (AI) regulatory obligations and rules set to take effect, organizations face immediate compliance deadlines.

Against this backdrop, assets are the proverbial treasure chest, and a comprehensive asset inventory is the map that contains information about all assets in an organization.

When teams fail to defensibly dispose of data and uphold rigorous deletion and retention practices across all information sources, an array of legal, compliance, financial, and operational risk can quickly accumulate.

As digital transformation continues to evolve globally, SAP’s role as a technology partner remains vital—helping organizations navigate an increasingly complex landscape and manage risk, including critical vulnerabilities that could threaten enterprise operations.

Until cyberrisk registers evolve to adopt the more tangible language used to describe enterprise value, they will remain static documentation tools that are useful for compliance but inadequate for advancing organizational goals.

One of these areas for improvement has to do with the actions taken when an employee departs from an organization. The moment an employee leaves the organization marks the start of a series of critical actions related to information security and regulatory compliance that frequently goes ignored.

Organizations must significantly decrease their willingness to accept risk and strongly increase their commitment to better monitor and secure these environments.

Shadow AI resembles shadow IT, a problem associated with unauthorized technological innovations circumventing formal enterprise IT controls.

The traditional boundaries between privacy, cybersecurity, and legal functions must give way to integrated governance if organizations are to meet emerging regulatory expectations, reduce systemic risk, and preserve trust in a future increasingly shaped by artificially-derived decisions.

Vibe coding refers to the practice of developing software applications through the use of natural language instructions with the assistance of generative artificial intelligence (gen AI) systems and agentic AI.

For most organizations, aligning with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) feels like a logical choice.

Agentic AI presents a growing challenge for audit and governance functions, primarily because its decision-making processes often lack clear traceability.

Today's IT auditors are agile, curious, and committed to continuous learning, ensuring that they remain effective and relevant in the face of new challenges.

Securing data is a highly challenging task and is quickly becoming a top priority for organizations as emerging technologies continue to advance and shape the way data is handled.

Due to their vast potential, these tools and their implementation have become the top focus for AI spending in most tech budgets. However, as these technologies become more sophisticated, they also present new vulnerabilities.

The developers of AI products and business leaders may not be asking the important questions—or worse, they are disregarding the troubling answers to these questions...

AI excels at processing information but lacks emotional intelligence. Without this, it cannot form human connections or successfully lead within an organization

Artificial intelligence (AI), especially generative AI, has been dominating headlines and enterprise conversations in recent years.

Agentic AI represents a breakthrough in technological innovation, but the capabilities of AI agents remain somewhat mysterious and warrant further exploration of their essential components. Organizations must understand this new technology and implement proactive security practices to harness agentic AI, a significant force multiplier in recent times.

Enterprises are becoming increasingly aware of advanced phishing and social engineering attacks, recognizing that a strong cybersecurity awareness culture is essential for defending against these sophisticated threats.

As innovative technologies such as artificial intelligence (AI) and big data analytics evolve and as supply chains become more convoluted and intertwined, the attack surface of organizations deploying a wealth of IoT devices expands significantly.

As cyberscams grow increasingly complex and difficult to detect, it is imperative that cybersecurity professionals not only recognize the severity of these scams but also take proactive measures to fortify both personal and organizational defenses.

Cybercriminals are constantly refining their tactics, and many organizations fail to keep pace with newly evolved threats due to inadequate security training and obsolete IR plans.

GenAI has the potential to improve the audit function’s efficiency and effectiveness. However, the use of GenAI does not come without risk, and organizations should be aware of that risk when implementing GenAI. It is of the utmost importance to identify and mitigate risk before implementing GenAI or any emerging technology.

While it is acceptable and commonplace to have work completed by another vendor based on mutually agreed contracts, the overall management of related risk is a pertinent point of attention.

Zero-ETL offers direct data movement capabilities and advanced cloud technologies and allows for the leveraging of modern architectural patterns to enable real-time data access while significantly reducing operational complexity and costs.

As organizations increasingly adopt Kubernetes for its scalability and flexibility, it is imperative to prioritize the security of both Kubernetes clusters and workloads.

While the world has been laser-focused on artificial intelligence (AI), major advancements are occurring in quantum computing.

The strategic chief information officer (CIO) must keep an eye not only on the evolving technology landscape, but also on evolving leadership and governance trends and their inevitable dilemmas, as these factors shape IT strategy and influence the way IT productively enables enterprise value creation.

ITis prudent to examine and debunk some of the most overt cybersecurity misconceptions and exaggerations circulating today and provide accurate information. This empowers organizations to reinforce their infrastructure and connected assets and technologies

Digital transformation initiatives have become a major investment priority as organizations strive to leverage technology to reshape business models, drive efficiency and growth, and gain competitive advantage.

MFA has the potential to revolutionize cyberdefense in the 21st century. There is value to be gained from delving into its benefits, limitations, and the possibilities it offers when integrated with emerging technologies.

There are 5 key risk areas that could provide guidance for auditors in today’s evolving privacy landscape. By identifying and defining these key risk areas, auditors can ensure robust and comprehensive privacy oversight

Digital transformation is reshaping the landscape of industries globally. While the benefits are enormous, these transformations can also jeopardize an organization’s governance standards if not executed with rigorous oversight.

Most organizations today have an IT environment that combines on-premises and cloud services. The preference to integrate these services has caught on widely, as it has proven flexible, scalable, and cost efficient.

The privacy profession is evolving to include multiple components of ethics, and privacy professionals must incorporate ethics-related considerations into their daily work.

For the past few years, many believed that the race for artificial intelligence (AI) supremacy was firmly in the hands of established players such as OpenAI and Anthropic.

Understanding what vulnerabilities exist, along with their potential severity and impact, can dramatically strengthen an organization’s cybersecurity posture and improve overall cyberreadiness.

The rapid shifts in the way the US executive branch addresses AI under different administrations illustrates why organizations are better positioned if they approach emerging technologies from risk-based and ethical perspectives.

In an era where technology is deeply embedded in every aspect of daily life, the healthcare industry is no exception—and cybercriminals have taken notice.

This article includes seven suggested steps or activities that organizations may find useful in operationalizing their WCRS programs or capabilities.

This article describes the limitations of traditional security solutions in addressing WCRS risk and proposes implementation options for purpose-built security solutions.

The term Web Client Runtime Security (WCRS) was coined by the authors to highlight the security or possible malicious behavior of the code executed in users' browsers during their web interactions.

As enterprise risk becomes increasingly intricate, the strategic execution of addressing multifaceted threats has grown more critical than ever.

There is no crystal ball to forecast the future; however, organizations can make informed predictions about cybersecurity in the coming year.

Automation and artificial intelligence (AI) have been a positive force multiplier in the cybersecurity industry. Improved time efficiency, resources, cost, and productivity are great strides in the field and should be celebrated.

When thinking about what makes up IT security, high-tech firewalls, robust encryption algorithms, and advanced threat detection systems are often the first things that come to mind.

In the organizational IT environment, system and data backup is crucial. Data backup is the last defense against downtime if data is corrupted or lost.

Quantum computing and blockchain bolster security measures, ensuring robust protection for sensitive data in cloud environments.

Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk.

In customer relationship management (CRM), emerging AI technology is vital for enhancing security measures.

The ever-increasing, and impressive, capabilities of quantum computers could potentially break current encryption methods, necessitating advancements in cryptographic techniques to safeguard sensitive information.

Organizations aim to empower stakeholders with generative capabilities that streamline workflows, transforming traditionally manual processes into automated efficiencies.

The adoption of generative artificial intelligence within enterprises has created an entirely new branch of governance and compliance risk.

In the realm of information systems, ensuring data integrity, security, and transparency are paramount.

Access to critical facilities should be controlled and such controls should be reviewed regularly for suitability, adequacy, and effectiveness, whether these controls are preventive, corrective, deterrent, or detective in nature.

To maximize the value and minimize the harms associated with emerging health technologies, it is critical to address ethical, privacy, and societal concerns to ensure that these technologies help rather than hurt humanity.

The initial enthusiasm surrounding blockchain technology has subsided, paving the way for a more pragmatic exploration of its real-world applications.

Naturally, this is much easier said than done, but by integrating these comprehensive and well-established cybersecurity frameworks, cyberprofessionals can craft their defense infrastructure to minimize risk.

To keep pace, organizations must familiarize themselves with crucial global privacy regulations and critical trends shaping the future of data protection.

The Evergrande Group scandal, wherein the company allegedly inflated its sales by US$79 billion despite audits by PwC, underscores the critical importance of robust IS audits.

This payment is likely the largest known ransom payment to date. Of course, many organizations pay ransoms without disclosing the details to the public, making it difficult to determine if this is the largest payment ever made.

Organizations can achieve their strategic goals and retain a solid ethical basis by integrating corporate governance frameworks with customer relationship management (CRM) plans. This vital integration leads to better results and a brighter future.

The increasing prevalence of ransomware attacks offers a unique learning opportunity. The experiences of diverse organizations across various sectors with a previous ransomware attack can provide practical lessons and invaluable insights for any enterprise to harness, empowering it to be better prepared and more resilient to ransomware attacks

Effective cyberrisk management in and of the cloud is important to safeguard sensitive data, maintain business continuity, and achieve regulatory compliance.

To ensure the smooth functioning of the IT department, it is essential to establish a well-structured IT audit department.

Deepfake scams have become a pervasive threat in the digital age. They use artificial intelligence (AI) to create convincing yet entirely fabricated videos and audio recordings. Deepfake scams have the potential to damage reputations, spread false information, and even manipulate financial markets.

As organizations grow more reliant on major providers, business continuity and preventing, mitigating, and recovering from disruptions to resume operations become even more critical.

The emergence of sophisticated AI methodologies capable of identifying individuals through intricate behavioral patterns amplifies these concerns and underscores the pressing need for robust privacy mechanisms and ethical frameworks in AI data training.

Persuasive technology is any digital system that influences user behavior or attitudes. Various interactive platforms, including social media, health apps, ecommerce websites, and educational apps, fall under this term. Persuasive technology urges users toward a desired outcome, whether that outcome is purchasing a product, adopting a better lifestyle, or staying hooked on a particular app or service.

It is crucial to understand the activities of this specific threat group, given their repeated successes in breaching security measures. Organizations must thoroughly understand Lapsus$ to proactively safeguard their data, rather than merely reacting to breaches.

There are real-world security challenges that organizations face when deploying AI. Therefore, it is essential to devise and execute practical strategies that assist organizations in risk mitigation.

Security leaders agree that regulatory compliance is not an effective security strategy, yet the protection of data in most organizations is strictly limited to regulated data. Overcoming this paradox is necessary to build effective data security programs that both protect data and meet regulations.

Many organizations are still trying to determine their AI strategy, and the pipeline security and ethics of large language models (LLM) must be factored into this. As organizations increasingly integrate AI into their operations, it is crucial to understand that it is not a one-stop solution.

Third-party collaboration has evolved into a necessity for most organizations in today’s market. However, the challenges of managing a third-party risk program can be overwhelming.

It is crucial to understand the inner workings of an AI system through these algorithmic audits that will provide us with insights into various aspects like training data, model development and training, and the underlying logic of AI systems. This information will enhance our confidence in the outputs of AI systems by verifying adherence to other principles of responsible AI.

An often overlooked means to significantly reduce risk has been hardening systems, technologies, and network infrastructure.

In the evolving digital landscape, enterprise IT departments are finding cybersecurity to be an indispensable shield, safeguarding innovation.

In an era dominated by digital advancements, the importance of accessible information and resilient cybersecurity practices cannot be overstated.

Addressing the specific security concerns inherent in cloud computing within the pharmaceutical industry is pivotal for safeguarding sensitive data and ensuring regulatory compliance.

In the swiftly advancing digital world, the role of third-party risk management (TPRM) has gained unprecedented importance.

The Russian state-sponsored threat group Sandworm, operated by military cyberwarfare unit 74455, is one of the most formidable global cyberthreat collectives in recent memory.

Today’s infosec teams often face new and complex challenges in an increasingly unpredictable digital environment. They are responsible for protecting an overwhelming amount of data across multiple systems.

Every journey to establish SAP security should begin with IT personnel identifying control weaknesses by bringing all stakeholders—security, audit, and compliance teams—into the fold.

The 5 Pillars of Security Framework offers a straightforward and business-friendly methodology for addressing cybersecurity challenges.

Cloud engineering and security leaders can implement streamlined solutions to protect their online environments without compromising productivity—while still achieving compliance.

An FTX empowers enterprises to test their abilities and prepare their cyberrisk teams to defend against dreaded cyberattacks that occur far too often today.

An organization’s employees are one of its most valuable assets and its most vulnerable cyberattack surface.

ISACA’s Digital Trust Ecosystem Framework (DTEF) can help enterprises ensure that broad organizational objectives and goals—including those relying on collecting and processing personal information—align with privacy objectives and compliance requirements.

Adherence to data privacy protection standards is of the utmost importance to cyberprofessionals. On today’s technology-driven, information-intensive landscape, the information security function is made more complicated due to new sources of sociotechnology risk.

It is imperative to examine the top cyberthreats faced by enterprises today and consider what preventive measures can be taken to safeguard digital assets and privacy.

Over the years, ransomware attacks have increasingly grown more common, costly and consequential, making it critical that organizations understand the latest threats and implement solutions to keep their (and their customers’) data secure—and their operations thriving.

Enterprises require a balanced scorecard-based tool to proactively safeguard their assets from unforeseen threats.

The MOVEIt Transfer hacking campaign epitomizes the threats faced in an increasingly interconnected world.

Vendor management is a fundamentally critical function that impacts an organization's operational success, efficiency, reputation and risk exposure.

A cybersecurity audit empowers organizations of all sizes to help identify and mitigate their cybersecurity risk.

In the digital age, cybersecurity is paramount for every organization, yet building a strong cybersecurity culture remains a challenge.

TA505 has emerged as one of the most sophisticated and prolific threat groups of 2023. Organizations can protect themselves by implementing countermeasures intended to mitigate risk.