Ciso

A practical guide to security metrics for 2026: what makes a metric good, how KPIs differ from KRIs and KCIs, leading versus lagging indicators, how to report differently to the board, the CISO and the SOC, the classic core set worth tracking, and the AI-era metrics most programs are still missing. No made-up industry averages — learn how to set your own targets instead.

A step-by-step guide to building a security metrics program that executives trust and the SOC actually uses: tie metrics to decisions, pick a small core set per audience, define each metric precisely, baseline before you set targets, automate collection, report differently to the board and the SOC, and review and retire vanity metrics. Includes a section on adding AI-era metrics. No fabricated statistics — a framework for setting your own.

A 2026 Semperis ransomware report, covered by The Register, finds 37% of ransomware attacks now involve psychological or physical threats against staff — doxxing, swatting, threats to families, even packages sent to investigators' homes. Here is what the numbers say, the caveats that come with a self-reported vendor survey, and what the shift from data-encryption to human coercion changes for incident-response planning and a security leader's duty of care.

A ranked table of 12 major enterprise infrastructure vendors by CVSS 10.0 vulnerability count and confirmed exploitability through September 2026, with Cisco's record advisory cluster and board-ready framing for CISOs.

A cyber insurance comparison built entirely on cited primary sources — NAIC, Aon, Marsh, NetDiligence and Coalition’s own claims data — instead of the invented per-control discount formulas most comparison articles repeat without a source.

A practical walkthrough of how to run a NIST CSF 2.0 assessment: the six Functions, the four Implementation Tiers, self-assessment vs. formal review, common pitfalls, and how to turn the result into a roadmap your board will approve.

Free, browser-based CISO training games — no signup, no tabletop scheduling. Practice phishing judgment, MFA-bombing triage, threat-actor ID, and boardroom pitches in minutes.

A practical guide to what actually drives data breach cost, why a flat cost-per-record number is misleading, and how to model your own exposure — plus a free calculator.

Prompt injection explained for practitioners: direct vs. indirect attacks, why tool-calling agents make it worse, real attack patterns, and the defenses — treat tool output as data, scan it, and constrain what agents can do.

How AI labs detect AI misuse with monitoring, classifiers and threat intelligence, plus the AI trust and safety lessons CISOs can apply to their own AI.

A defensive brief on a fast-rising risk class: malicious or compromised LLM routers and MCP gateways that inject unintended tool calls, steal credentials in transit, and pivot across hosts. What the attack looks like, why it scales, and the controls that actually contain it.

Cl0p's dark-web leak site has listed four organizations as alleged victims. These are unverified extortion claims, not confirmed breaches. Here is how to read a leak-site listing, why Cl0p keeps hitting file-transfer software, and the defensive steps that actually matter.

A practical guide to using Google Authenticator and Microsoft Authenticator safely: TOTP vs push, number matching, resisting push-bombing, cloud backup risks, device binding, recovery, and where passkeys beat OTP. With personal and enterprise checklists.

A concrete, admin-ready guide to hardening Microsoft Teams: external access and federation controls, guest and app governance, meeting policies, phishing defense, token-theft and Conditional Access, DLP, and Purview monitoring.

A practical guide to locking down Zoom: waiting rooms, passcodes, join restrictions, host controls, screen-share limits, E2EE trade-offs, recording retention, data residency, app governance, and SSO/SCIM, with a ready-to-use checklist.

A CISO and Workspace admin guide to locking down Google Meet: Quick access and knocking, authenticated and same-org joins, moderation, dial-in, recording and Drive retention, Context-Aware Access, MFA, and audit logs.

The IT service desk is now a primary attack surface. Learn the Scattered Spider playbook and the concrete identity-verification, monitoring, and Conditional Access controls that stop attackers from calling in to reset passwords and MFA.

A concrete SOC and IAM watch-list of the behaviours and attributes — impossible travel, MFA changes, privilege escalation, leaked credentials and more — that should raise a user's risk score, why each matters, and how to respond.

A CISO and IAM architect's guide to FIDO2, WebAuthn, and passkeys: why they are phishing-resistant, platform vs hardware and device-bound vs synced options, attestation and AAGUID, and an assessment checklist for deployment.

A defensive threat-intelligence explainer on the venue types that power the ransomware economy - forums, RaaS portals, initial-access brokers, leak sites - and how defenders and law enforcement monitor and disrupt them.

A defensive awareness briefing for CISOs and staff on how ransomware operations recruit affiliates and insiders, the traits they hunt for as red flags, the manipulation tactics they use, the legal and personal consequences, and how to recognize and avoid being pulled in.

An analytical look at the ransomware business: the RaaS affiliate model and revenue splits, how demands are sized and negotiated, the crypto rails crews use -- and how blockchain analysis and law enforcement follow and seize the money.

Inside the operational security ransomware operators use to stay anonymous, and the recurring OPSEC mistakes, blockchain tracing, infrastructure seizures and leaks that keep unmasking them anyway.

A practical roadmap for security leaders preparing to step into the CISO seat — from closing executive skill gaps to practicing board-level decisions under pressure, with the tools and frameworks that actually build readiness.

A practical comparison of the platforms security leaders are using in 2026 to develop executive skills, practise board communication, and prepare for the CISO role — from simulation-based training to certifications and peer networks.

A comparison of the interactive incident response simulators available in 2026 for security leaders preparing for CISO and executive roles — from AI-driven War Room scenarios to tabletop exercise platforms and cyber range tools.

Security architects eyeing executive roles need to master board-level communication and incident reporting. Here are the platforms and tools available in 2026 for practising these skills — from AI-driven report coaches to crisis communication simulators.

CISO candidates need to practise breach response at the executive level — disclosure decisions, regulatory notifications, board communication, and crisis management — before they are responsible for doing it for real. Here is how to build that muscle.

A maintainer account compromise poisoned keyv, flat-cache, file-entry-cache and the rest of the family, then spread to 868 more packages across 1,381 versions — over 2 billion monthly installs. The releases were signed by GitHub Actions and the provenance checks out. That is the part worth your attention.

Researchers say Kimi K3 agents chained a Redis streams double-free with a RedisBloom heap overflow into working authenticated RCE, with one exploit produced in 27 minutes. Redis shipped seven security releases in response. The claims are self-reported — but the patches are real.

Researchers found residential proxy SDKs in 42% of LG webOS apps and over 25% of Samsung Tizen apps, quietly turning hundreds of millions of home TVs into proxy nodes rented out to unknown third parties. LG is suspending non-compliant apps; Samsung has said nothing yet.

Live video can now be edited faster than you can blink — faces swapped, backgrounds changed, all in real time on a webcam stream. Here is why that breaks video-based identity verification, supercharges executive impersonation fraud, and what security leaders should do about it.

A hacker used the self-propagating Shai-Hulud npm worm to breach AI music company Suno, leaking source code that details how its training corpus was scraped — plus customer emails, phone numbers, and Stripe data. Here is what actually happened and what security leaders should take from it.

A deep dive into the Domain-to-Domain (D2D) agentic protocol — the coordinator, worker, and killer node model that lets autonomous AI agents collaborate across security domains without human-in-the-loop bottlenecks.

Lessons from wiring up a D2D multi-agent system to a production SOC: the PagerDuty integration, the human review queue, what broke, and what surprised us.