Adam Wojnicki

Traditional CISO Vs. Modern CISO This is a powerful and provocative take on the evolving role of the Chief Information Security Officer (CISO). It draws a sharp contrast between the Traditional CISO, who waits for direction and relies on fear-based messaging, and the Modern CISO, who proactively aligns security with business outcomes and drives strategic value. Here are a few key themes worth highlighting: 🔑 Core Message Breakdown Traditional CISO: --------------------- Reactive Focused on compliance and risk translation Dependent on others to prioritize security Uses fear-based tactics (e.g., threat landscape slides) Modern CISO: --------------------- Proactive and strategic Speaks the language of business (revenue, resilience, ROI) Builds the case for security investment Leads like an operator, not just a technologist 💡 Why This Resonates Today Security is now a business enabler, not just a cost center. Boards and CEOs want measurable impact, not abstract risks. The best CISOs are storytellers and strategists, not just technologists. “Shared responsibility” is valid, but leadership is not shared—someone must own it. 🔥 If You’re a CISO or Aspiring to Be One… Ask yourself: Can you tie your security initiatives to business KPIs? Are you influencing product, revenue, and customer trust? Do you have a seat at the table—or are you still waiting for one?

503

60 Kommentare

"Explained: GPAI Code of Practice - Safety & Security Chapter 1", co-prepared by Matthias Samwald, Marta Ziosi, Alexander Zacherl, Yoshua Bengio, Daniel Privitera, Nitarshan R., Marietje Schaake, Anka Reuel, & Markus Anderljung, and published now in July 2025 by AI & Partners. 👇 This report outlines the safety and security practices set out in the #GPAI Code of Practice. The document details commitments and measures for systemic risk assessment, mitigation, and reporting. It outlines evaluation protocols, defines responsibilities, and promotes a strong risk culture. It also includes appendices on model evaluations, risk scenarios, and robust security mitigation #strategies. Link: https://lnkd.in/d8zUpErq #artificialera #web3 #web4 #web5 #fintech #digitalera #digitaltransformation #ailaw #machinelearning #deeplearning #generativeAI #trustworthyAI #explainableAI #aiethics #artificialintelligence #explainableAI #responsibleAI #foundationmodels #GPAI #GAI #LLMs #NLPs #GenAI #frontierAI #narrowAI #AGI #ethicalAI #adversarialAI #RAG #agenticAI #AIagents

93

RFID Cybersecurity: Everything you always wanted to know about it but were afraid to ask (in 99 slides!). 🏷️🪪🧲😈 Security experts Kirils Solovjovs and Iceman shared their knowledge of RFID cybersecurity last month, covering everything from the basics to advanced techniques in penetration testing and protocol security analysis. This is one of those presentations you’ll come back to every time you start RFID research. Make sure you keep a copy and share it with your friends and colleagues (both security and dev). P.S. Quick note on the unusual timing - I just got back from the desert :) More details: Decoding RFID [PDF]: https://lnkd.in/dMtU48G7 #technology #wireless #RFID #infosec #cybersecurity #cyber #security #hacking #attack #innovation #future

298

14 Kommentare

🔓 IDOR is Everywhere — You Just Need Patience 🧠 In the world of bug hunting and cybersecurity, some of the most critical vulnerabilities are often hidden in plain sight. Insecure Direct Object Reference (IDOR) is one such vulnerability — simple, yet incredibly powerful. It's not about complex payloads or flashy exploits. It's about observation, logic, and above all, patience. 💡 Whether it’s a user ID in a URL or a file reference in an API, IDOR flaws can exist in the most unexpected places — waiting for someone patient enough to spot the difference. If you're into ethical hacking or just starting out in bug hunting: 👉 Never ignore the basics. 👉 Test like a user, think like an attacker. 👉 Stay persistent. Remember: “IDOR isn’t rare — the mindset to find it is.” #CyberSecurity #BugBounty #EthicalHacking #IDOR #AppSec #InfoSec #BugHunter #HackingMindset #WebSecurity #ThinkLikeAnAttacker

358

27 Kommentare

Our article titled “Perceptions of Digitalisation and Cyber Security: Impacts on Organisational Practices through the NIST Cybersecurity Framework” has been published in the Journal of Decision Systems (Taylor & Francis Group)! In this study, we examined cybersecurity perceptions and organizational practices during the digital transformation process, using the NIST Cybersecurity Framework v2, which was released in 2024, as our foundation. Insights from 124 professionals across various sectors reveal a significant gap between perceived awareness and actual readiness. The cyclical structure of the updated NIST CSF also highlights how it can enhance organizational cybersecurity maturity. As digitalization accelerates with AI and IoT, the need for proactive and adaptive strategies becomes increasingly important. Full article: https://lnkd.in/dRURbJmX Many thanks to my co-authors Assoc. Prof. Burcu Kör and Assoc. Prof. Nazim Taskin for their valuable collaboration. I believe the cyclical nature of the NIST Cybersecurity Framework v2 should be seriously considered as a foundational element for effectively implementing organizational cybersecurity. #Cybersecurity #DigitalTransformation #NISTCSF #Research #JournalPublication

80

3 Kommentare

🌟 2025-2028: An era of transformation for #CISOs Based on discussions with numerous cyber professionals in the #US 🇺🇸 and #Europe 🇪🇺, I believe the next three years will be defining for my #CISO friends and clients. The role of Chief Information Security Officers will undergo profound changes. Let's delve into four pivotal shifts: 1️⃣ Skyrocketing salaries 💵: The ongoing talent shortage and the still-less-than-glamorous appeal of the #cybersecurity sector will drive salaries through the roof. The job's immense pressure and the need to prepare for personal cyber-liability insurance coverage (when not covered by D&O insurance policies) will further fuel this trend. Additionally, expect increased scrutiny by regulators around CISO equity and bonuses💰 to ensure CISOs remain motivated to report incidents transparently. 2️⃣ Splitting the #CISO Role 👥: The system of lines of defense is gaining popularity across all sectors, not just finance. Many CISOs are shifting to a second-line role focused on strategy, risk management, and assurance/testing 🔎. Consequently, we're seeing the emergence of technology-focused CISOs under the #CIO, responsible for execution. For years, we've debated whether the CISO should report to the risk officer or the CIO. Now, it's both... with two distinct individuals 📈 3️⃣ #CISO Stratification 🧭: Companies are increasingly choosing their CISOs based on their current cybersecurity posture. Post-incident? They call in crisis CISOs to manage the fallout🔥 Facing regulatory pressure? They hire remediation CISOs to build large-scale cybersecurity plans. In stable times, BaU CISOs keep things running smoothly. This shift is creating clear tiers within the profession, with distinct profiles emerging 👥 - and driving faster turnover as organizations switch leaders to fit the moment. It’s especially true in U.S. banks, where the average CISO tenure is now just 30 months! 4️⃣ Evolution to #CSO: Cybersecurity functions are increasingly overlapping with other security domains like product security, e-fraud, IT risk, and operational resilience 🌐. Businesses are demanding more coherence in security practices, and some areas like #InsiderThreat are managed inconsistently. In the next three years, we'll likely see key services extending beyond cybersecurity, such as Fusion Centers (an evolution of SOCs🔎) and Business Intelligence (an extension of #ThreatIntelligence). The good news is that the CSO is now perfectly positioned to integrate #IAM, which has been neglected for years in the organization ;-) These predictions are not just about salary or minor changes but signal a paradigm shift in how we perceive and value the role of cybersecurity leaders 📈. #CISOs are not just tech guardians; they are strategic business enablers and risk managers! Let's watch these predictions unfold in the next three years and prepare to support our CISO community! 🎯 #GetReady #Transformation

114

7 Kommentare

⏳ Time is crucial in Incident Response ⏳ In one incident, the victim engaged Talos IR immediately after discovering malicious activity alerts. Talos IR worked swiftly to combat additional malicious activity and prevented the execution of any encryption in the environment. Conversely, in a second incident, the victim ignored alerts of malicious activity and did not contact Talos IR until after the ransomware binary began to execute. Talos IR was then not provided network access for analysis for over a day, during which time the actors achieved nearly 100% host encryption. Full article here: https://lnkd.in/enpX5CuB

98

7 Kommentare