When platforms like Canvas or the underlying cloud providers experience outages, the impact is immediate and personal: Exams are postponed, schedules are disrupted, grades are delayed and students question whether the institution is as reliable as its marketing suggests. That’s not a “technical hiccup.” It’s a hit to student experience, and ultimately to retention, recruitment and revenue. Cybersecurity leaders who continue to talk in terms of patches, vulnerabilities and scan counts are missing the moment. The institutions that are evolving are those where CISOs are now business enablers, not just technical guardians. The Modern Higher Ed CISO: Business Leader First, Technician Second Thirty years ago, a CISO or security practitioner was often buried inside IT, there to fulfill compliance requirements and keep systems “secure enough.” Reporting lines and expectations reflected that. Today’s reality is different. Modern CISOs must be able to answer questions like: - How does our security posture help us retain current students and attract new ones? - How does it support new research initiatives and the grants tied to them? - How does it protect our intellectual property and institutional reputation? That requires business acumen: understanding funding models, student lifecycle, research pipelines and competitive positioning. It also requires the courage to move away from purely technical metrics and speak in the language of outcomes. WATCH: IT leaders share their CIO playbook best practices when cybersecurity threats surge. Demonstrate Business Value Through Outcomes Fear‑based arguments such as breach headlines, critical vulnerabilities and compliance fines might get attention, but they rarely sustain investment. Boards and CIOs increasingly want to know, what do we get for this spend? That’s where outcome‑based framing comes in: - Instead of “we patched 3,000 systems,” say, “we ensured 100% uptime for the 55 systems that drive tuition revenue and student success.” - Instead of
Jul 13, 2026 · via edtechmagazine.com
The EU Agency for Cybersecurity (ENISA) publishes the Micro, Small and Medium-sized enterprises (SME) Cyber Resilience Maturity Assessment Model, a simple and practical guidance for SMEs to support them assess their current status, identify improvements and strengthen their cyber resilience practices. As SMEs make up a large part of EU´s digital ecosystem, their ability to understand and implement the Cyber Resilience Act (CRA)is significant for the regulation’s success. Particularly, as smaller organisations face practical challenges related to resources, expertise, time and implementation capacity. To help address this, as part of the European Commission’s SME cybersecurity strategy, ENISA is working on practical guidance, tools and support activities tailored to the realities and needs of smaller organisations. The SME Cyber Resilience Maturity Assessment Model provides a structured approach for SMEs to evaluate and strengthen their overall cyber resilience, while taking into account the requirements of the CRA. The model is primarily intended for organisations that manufacture and place products with digital elements on the market, as these are directly subject to CRA requirements. However, it can also be used by other organisations involved in the product life cycle, such as integrators or service providers, to assess and improve their product security practices. It focuses on the following five domains, with each domain divided into five maturity criteria that reflect expected practices under the CRA and product security approaches: - governance and documentation, - risk management and security by design and by default, - vulnerability and patch management, - product life cycle management, - awareness, competence and skills. The model suggests three maturity profiles: basic, intermediate and advanced, intended to show how consistently product-related risks are managed in the organisation. Overall, this model reflects practices supporting the implementation of the CRA and supports organisations in strengthening their product security and cyber resilience over
Jul 13, 2026 · via enisa.europa.eu
3D Printing Cybersecurity Market to Grow 22.5% Annually The global cybersecurity market for 3D printing machines is projected to grow from US$120 million in 2026 to US$910 million by 2036, at a 22.5% CAGR, as manufacturers strengthen protection against cyberattacks targeting digital design files, cloud-based additive manufacturing workflows and safety-critical production environments. As additive manufacturing becomes a core production technology for industries such as aerospace, defense and healthcare, cybersecurity is emerging as a business requirement rather than an operational consideration. A new study from Meticulous Research projects the global cybersecurity market for 3D printing machines will expand from an estimated US$120 million in 2026 to US$910 million by 2036, reflecting a compound annual growth rate of 22.5%. The forecast highlights how manufacturers are responding to a growing threat landscape in which digital design files, connected printers and cloud-based production environments have become valuable targets for cybercriminals. As 3D printing shifts from prototyping to manufacturing mission-critical components, securing the digital workflow has become increasingly important for protecting intellectual property, ensuring product integrity and meeting regulatory requirements. Cyberattacks Turn 3D Printing Security Into a Business Priority Unlike conventional manufacturing, additive manufacturing depends on digital files that define every aspect of a component. Those files are transferred across software platforms, cloud environments and production equipment before becoming physical products. Each step creates opportunities for unauthorized access, data theft or manipulation. A compromised design file can result in counterfeit products, intellectual property theft or subtle modifications that weaken a component without altering its appearance. In sectors where printed parts are installed in aircraft, medical devices or industrial equipment, those alterations can introduce operational and safety risks beyond financial losses. As a result, organizations are expanding investments in technologies such as encryption, access controls, secure file transfer and traceability solutions to protect the complete digital
Jul 13, 2026 · via mexicobusiness.news
CYBERSECURITY BREAKING: Pentagon Suspends Phase 2 of CMMC Program By Josh Luckenbaugh iStock illustration The Defense Department announced July 13 that it was suspending the Phase 2 requirements for its Cybersecurity Maturity Model Certification program and that it would be conducting a comprehensive review of the initiative to ensure it aligns with Secretary of War Pete Hegseth’s Acquisition Transformation Strategy. The program, known as CMMC, is meant to be the department’s mechanism for verifying defense contractors are compliant with its cybersecurity requirements. Phase 1 of the program began Nov. 10 of last year and required companies to self-assess compliance at two security levels. Phase 2, which would have begun on Nov. 10, would have seen the introduction in applicable Pentagon solicitations of CMMC Level 2 requirements for companies to be certified by a third-party assessment organization. But while CMMC was designed to enhance the defense industry’s cybersecurity, “instead it has created prohibitive compliance costs and bureaucratic burdens,” according to a Defense Department release. Small Business Administration reports have shown that “CMMC compliance is forcing innovative companies out of the defense industrial base, which will delay the delivery of critical capabilities to the warfighters,” it said. To support Hegseth’s directive as part of his Acquisition Transformation Strategy to reduce compliance barriers for small and medium-sized businesses, the department is suspending CMMC Phase 2 requirements, Pentagon Chief Information Officer Kirsten Davies said. “Robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness,” Davies said in the release. “We believe the [defense industrial base] can achieve both, while we reduce unnecessary government red tape.” Additionally, pending and future CMMC implementation milestones in Pentagon solicitations and contracts will be suspended, the release stated. However, Phase 1 self-assessment requirements remain in place. Meanwhile, Davies is establishing a CMMC Reform Task
Jul 13, 2026 · via nationaldefensemagazine.org
The challenges, opportunities of open source intelligence for cyber defenders Federal Insights Read more
Jul 13, 2026 · via federalnewsnetwork.com
The first program is aimed at the state’s water and wastewater operators, which have until July 31 to apply for the Safe Drinking Water Cybersecurity Grant Program (SDWCGP). At the same time, New Jersey is also accepting applications through Sept. 11 for its Nonprofit Security Grant Program, which supports eligible security technologies and facility upgrades. The SDWCGP is offered by the New Jersey Office of Homeland Security and Preparedness, and it is focused on four areas: governance and planning, risk management, resilience and workforce development. Taking a whole-of-state approach, the office’s Cybersecurity and Communications Integration Cell (NJCCIC) will directly procure software, services and training to be provided to awardees. Tools include endpoint detection and response, managed detection and response, and multifactor authentication, among others. Workforce development offerings include in-person and remote training on cybersecurity awareness, IT and operational technology security, cyber operations, incident response, and threat and vulnerability management. The program was established with $4 million in early 2024. Organizations that serve New Jersey communities and residents are eligible, but they must join the NJCCIC and complete an online assessment before submitting an application. While the utility program focuses on critical infrastructure cyber readiness, a separate nonprofit grant program supports organizations that may face elevated security risks. The New Jersey Nonprofit Security Grant Program, a permanent state program, is taking applications for funds toward approved physical security improvements as well as IT and cybersecurity equipment for eligible organizations. Eligible parties may apply for both security personnel as well as for equipment grants, but applicants can only receive one award, according to the documentation. For equipment relating to cybersecurity, the list includes credentialing systems, software as a service applications, remote authentication, encryption software, firewalls and anti-virus software. Organizations may apply for up to $100,000 in this area. According to the state,
Jul 13, 2026 · via govtech.com
AI is giving elite security orgs new ways to automate red teaming, detection engineering, and vulnerability discovery. But experts debate whether the technology will deepen cyber’s long-standing resource divide — or finally help close it. At Amazon Web Services (AWS), artificial intelligence is already compressing security work that once took months into minutes. In the old world, human red teams would find vulnerabilities, write reports, refine those reports, and eventually hand them to defenders, who would then begin building detections or fixes, Steve Schmidt, chief security officer at AWS, tells CSO. That process could take “two, four, six, eight, 10 months,” Schmidt says. “Now with proper application of AI, we can have the detections built for the problems the red team finds in 15 minutes-ish,” he says. “I think the outside is about four hours.” That kind of workflow offers a glimpse of what AI could make possible for the most sophisticated security organizations: AI agents testing systems, other agents generating defenses, and human security engineers validating results and refining the feedback loop. But it also raises a more uncomfortable question for the rest of the cybersecurity industry: What happens to organizations that cannot build anything close to that? The concern has become significant enough that the Trump administration recently directed agencies to expand access to AI-enabled cybersecurity capabilities for resource-constrained organizations, including rural hospitals, community banks, and local utilities. The order reflects a growing fear that AI could deepen a divide that has existed in cybersecurity for years: the divide between organizations with money, expertise, and engineering depth, and those struggling to keep pace with basic security demands. Yet security leaders and practitioners suggest the impact of AI will be more complicated than a simple widening gap. Some experts say AI is merely adding a new layer to a
Jul 13, 2026 · via csoonline.com
CyberCUBE, ESAs mission to strengthen the cybersecurity of space systems, successfully launched from California Led by GMV for the European Space Agency, the mission relies on a 3U CubeSat platform developed by Alén Space and will serve as an in-orbit laboratory to validate cutting-edge space cybersecurity technologies The European Space Agencys (ESA) CyberCUBE mission, designed to strengthen the protection of space assets against growing cyber threats, has been successfully launched from the Vandenberg Space Force Base in California, aboard a Falcon 9 rocket. The mission, led by the multinational technology company GMV through its teams in Romania and Spain, also involves Alén Space, a pioneering New Space company that has been part of GMV since 2023. The successful launch of the satellite into orbit marks the start of a pioneering mission designed to validate cutting-edge cybersecurity technologies and capabilities applied to the space environment under real-world conditions. CyberCUBE is part of the Cyber Evolutions activities of ESAs Cybersecurity Operations Center (CSOC) within the framework of the Cyber Security Resilience programme, a cross-cutting initiative led by the Agencys Security Office to strengthen the protection of both its corporate systems and its space missions. CyberCUBE was designed as an in-orbit experimentation platform capable of providing ESA with a secure, flexible, and reconfigurable environment for demonstrating new cybersecurity technologies before they are incorporated into future European missions. The missions main goal is to validate the CSOCs data monitoring and analysis capabilities using actual space assets. At the same time, it will make it possible to test new onboard cyber capabilities and collect critical information to improve the resilience of space systems against emerging threats. Highlights of the planned experiments include detection and protection against unauthorised access to command-and-control systems, identification and mitigation of jamming and spoofing attacks, monitoring of onboard systems, and the
Jul 13, 2026 · via webwire.com
New IT firm launched to help SMEs tackle growing cyber security threats SecurePoint Managed IT Solutions (SecurePoint MIS) has officially launched, providing proactive managed IT services, cybersecurity solutions and strategic technology support to small and medium-sized businesses across the West Midlands and wider UK. The new venture has been founded by Matthew Sarabadu (pictured), who brings more than 16 years of director-level leadership experience at Thompson Group, where he has worked with organisations across multiple sectors to improve security, resilience and business continuity. Throughout his career, Sarabadu has witnessed the rapid evolution of technology and the growing convergence of physical security, cybersecurity and IT infrastructure. The launch comes at a time when many SMEs are facing increasing pressure from cyber threats, compliance requirements and the growing complexity of modern IT environments. Business owners often recognise the need to improve their technology but lack the internal expertise, resources or time to manage it effectively. SecurePoint MIS aims to bridge that gap by providing enterprise-grade technology services that are accessible, transparent and tailored to the needs of growing businesses. The company is founded on four core principles of proactive support, security by design, jargon free advice and long term partnerships. Matthew Sarabadu said: “Technology has become fundamental to every organisation, yet many businesses are still trying to manage IT, cybersecurity and operational resilience in isolation. “SecurePoint Managed IT Solutions has been created to bring those disciplines together, helping organisations build stronger, more secure technology foundations while giving business leaders confidence that their IT is supporting, rather than hindering, their growth. “SecurePoint Managed IT Solutions will provide a comprehensive portfolio of services including managed IT support, cybersecurity, Microsoft 365 and cloud services, backup and disaster recovery, endpoint protection, compliance support and strategic technology consultancy. “As businesses continue to navigate an increasingly complex technology
Jul 13, 2026 · via greaterbirminghamchambers.com
New Delhi: A department under the Ministry of Electronics and Information Technology (MeitY) has asked ministries not to deploy OpenAI and Anthropic’s models for cybersecurity and related functions for now, ThePrint has learnt, days after the two companies approached several ministries with their proposals. An office memorandum has been circulated to this effect, asking ministries not to put such models into use prematurely. The representatives of the two companies met officials across ministries to press for deployment, a source told ThePrint. The number of ministries approached and the level at which the meetings took place could not be confirmed. The Ministry of Finance was among those that wrote to the department, asking if the ministry could examine the use of agentic AI and the deployment of OpenAI models. In its six-page letter, reviewed by ThePrint, the Ministry of Finance specifically asked about deploying GPT-5.5 for cybersecurity work. The letter, titled ‘In light of LLMs being used: AI-based vulnerability discovery, AI-assisted cybersecurity capabilities and implementation’, set out proposals on what could be deployed and was sent for consideration. In a memorandum last week, the department returned a firm no. The source quoted above said the memorandum does not amount to a permanent restriction. The department’s objection is about the timing of deployment rather than a bar on the technology. The models in question Both companies market their frontier models for defensive cybersecurity: automated vulnerability discovery, in which a model scans codebases for exploitable flaws; code review; incident triage; and agentic deployment, where a model executes multi-step tasks with limited human supervision. The capabilities are dual-use. A model that finds a vulnerability in defensive testing can find one for offensive purposes, and both companies acknowledge as much in their published safety frameworks, which assign cyber capability thresholds to models and set restrictions
Jul 13, 2026 · via theprint.in
Rakuten Symphony Announces First Commercial Deployment of Integrated Vessel Cybersecurity Solution with Hanwha Ocean - Leading South Korean shipbuilder officially adopts Rakuten Maritime vessel cybersecurity platform Rakuten Symphony Inc. announced the official commercial deployment of its Rakuten Maritime vessel cybersecurity solution, securing a full-scale implementation agreement with South Korean shipbuilding giant Hanwha Ocean Co., Ltd. to integrate our platform across all stages of its vessel design, construction and operation. This commercial agreement marks a significant milestone for Rakuten Maritime, moving from strategic ecosystem partnerships to active market adoption. In collaboration with global partner CYTUR, the integrated solution provides comprehensive protection throughout the entire shipbuilding and operational phases. Through this deployment, Hanwha Ocean will integrate Rakuten Maritimes cybersecurity-by-design framework into its shipbuilding processes, strengthening cyber resilience from the earliest stages of vessel development. Full Lifecycle Cybersecurity Deployment During the high-value design phase, this deployment enables Hanwha Ocean to utilize specialized Threat Intelligence and Threat Modeler modules to identify and mitigate cyber risks before construction begins. The shipbuilder can also deploy Scanner portable technology for onboard equipment risk assessments, alongside active Threat Analysis and Risk Manager modules on its selected vessels currently under construction. This cybersecurity-by-design approach enables Hanwha Ocean to identify and address vulnerabilities early in the construction process, significantly reducing operational risks and potential costs after vessel delivery. Ryan Son, President of Rakuten Symphonys Internet Services Business Unit and Head of Rakuten Maritime, said: The official commercial adoption of our platform by a global shipbuilding giant like Hanwha Ocean is a massive validation of our technology. By integrating these tools from the outset of design and construction rather than treating security as an afterthought, Hanwha Ocean is establishing a new standard for proactive, lifecycle risk management across the maritime industry. Hanwha Oceans Merchant Ship Business Division commented: As vessel digitalization
Jul 13, 2026 · via webwire.com
The FIFA World Cup 2026 has not only been marked by intense competition on the football field but has also become the center of growing controversies involving cyber threats, misinformation, and digital manipulation. As the tournament progresses into its crucial stages, several incidents have raised concerns about how cybersecurity challenges are increasingly intersecting with major global sporting events. Over the past few days, tensions among participating football nations have escalated significantly. Allegations of unfair influence, controversial officiating decisions, and the spread of misleading online content have dominated discussions alongside the matches themselves. These developments have highlighted how digital platforms can amplify controversies and create confusion during high-profile international events. One of the earliest controversies involved accusations directed at U.S. President Donald Trump, with critics claiming that political influence played a role in a red card decision that benefited a U.S. player. The allegations quickly spread across social media and generated strong reactions from several football communities, particularly in South America and other regions. Although no credible evidence emerged to support the claims, the incident demonstrated how speculation can rapidly gain momentum during globally watched sporting tournaments. Another widely discussed episode was the so-called “Spidercam Gate” involving England and Norway, on a recent note. During the match, the football reportedly contacted a cable supporting the stadium’s spider camera system. The unusual incident sparked debates over whether the play should have been paused or lead to a penalty, with fans and commentators questioning the interpretation of the rules. While tournament officials addressed the matter, the event continued to fuel online discussions and media attention. The latest controversy, however, has shifted from the playing field to cyberspace. The Argentina Football Federation (AFA) issued a public clarification stating that reports claiming its servers had been compromised by an Egyptian hacking group were false. According
Jul 13, 2026 · via cybersecurity-insiders.com
Cybercriminals are increasingly shifting their focus from exploiting software vulnerabilities to targeting human psychology. Among the most successful examples of this trend is the Boss Scam, a sophisticated social engineering attack in which threat actors impersonate senior executives to manipulate employees into transferring funds, disclosing sensitive information, or bypassing established security controls. Also known as Business Email Compromise (BEC) or executive impersonation fraud, the Boss Scam has become one of the most financially damaging cyber threats facing organizations worldwide. Unlike ransomware or malware attacks that rely on technical exploitation, Boss Scams are built on deception and trust. Attackers spend considerable time conducting open-source intelligence (OSINT) to understand an organization’s hierarchy, executive leadership, financial processes, and employee responsibilities. Publicly available information from corporate websites, LinkedIn profiles, press releases, and social media accounts enables threat actors to craft highly convincing impersonation campaigns. The attack often begins with a fraudulent email that appears to originate from a CEO, CFO, or another senior executive. In some cases, attackers compromise legitimate corporate email accounts, while others register lookalike domains that differ from the official company domain by only a single character. The objective is simple: convince an employee to execute an urgent financial transaction or disclose confidential business information without following normal verification procedures. Recent years have witnessed the evolution of Boss Scams beyond traditional email-based attacks. Cybercriminals now leverage collaboration platforms such as Microsoft Teams, Slack, WhatsApp, and Signal to impersonate executives. The rapid advancement of artificial intelligence has further enhanced these attacks, enabling criminals to generate grammatically flawless emails, clone executive voices, and even create deepfake video messages capable of deceiving employees during virtual meetings. These emerging capabilities have significantly increased the credibility and success rate of executive impersonation attacks. One of the defining characteristics of a Boss Scam is psychological manipulation. Fraudulent
Jul 13, 2026 · via cybersecurity-insiders.com
Why SBOMs, signing, and provenance still don’t tell you if software is safe We have made real progress in software supply chain security, improving visibility into software components, authenticity and build integrity. Much of this progress traces back to Executive Order 14028, which pushed agencies, contractors and enterprises to invest in SBOMs, signing and provenance. All of that matters, but it is not enough. The current software trust model still stops short of the question that determines risk at execution: What is this code capable of doing if it runs? This blind spot is becoming harder to ignore as AI changes the speed, scale and variability of malicious software. University of Toronto research demonstrated an AI-powered worm capable of adapting its attack strategy as it moves through a network. Unlike traditional worms that exploit a fixed vulnerability, this prototype can reason through new attack paths and tailor its behavior to different systems. The June 2026 AI executive order on cybersecurity reflects federal concern. But the issue is broader than policy: traditional trust models are insufficient when AI generates, modifies and deploys code faster than human review can keep up. We can no longer trust software based primarily on what it is, where it came from or whether it resembles something seen before. Visibility is not trust SBOMs answer an important question: What is inside this software? Organizations cannot manage dependencies, open-source exposure or known vulnerable components if they do not know what is inside a build. But composition is not behavior. A package can have a clean dependency tree and still perform dangerous actions. An application can include expected libraries and still attempt credential access, persistence, lateral movement, file modification or data exfiltration. SBOMs help security teams understand ingredients, but they do not predict what software will do once it
Jul 13, 2026 · via helpnetsecurity.com
Global Cybersecurity Market Size is Expected to Reach USD 199.75 Billion by 2026 Cybersecurity refers to the comprehensive set of technologies, practices, and measures designed to protect computer systems, networks, and data from unauthorized access, attacks, damage, or leakage. It encompasses areas such as information protection, authentication, access control, intrusion detection, firewalls, and encryption, aiming to ensure the confidentiality, integrity, and availability of data. Cybersecurity is relevant not only to enterprises and government organizations but also to individual users, addressing threats like cyberattacks, malware, ransomware, phishing, and insider risks, and relies on risk assessment, vulnerability management, and implementation of security policies to prevent potential breaches.Cybersecurity Market Overview According to WENKH research statistics, the Cybersecurity market size is set to climb from $199.75 billion in 2026 to $411.58 billion by 2033, achieving a compound annual growth rate (CAGR) of around 10.88%. Driven primarily by the widespread adoption of digital business models across industries, the scale of online data assets and interconnected systems continues to expand, leading to a growing number of potential cyber exposure points. As cyber threats become increasingly sophisticated and frequent, enterprises, governments, and organizations are placing greater emphasis on protecting critical information infrastructure, business operations, and digital assets. The steady increase in practical demand for security solutions, risk management, and threat prevention capabilities is directly supporting the sustained long-term growth of the global cybersecurity market. Cybersecurity Competitive Landscape According to WENKH's in-depth research, key market players of Cybersecurity include Palo Alto Networks, Cisco, IBM, Fortinet, Check Point, McAfee, Trend Micro, Broadcom (Symantec), QI-ANXIN, RSA Security, Venustech, CyberArk, Sangfor Technologies, TOPSEC, Rapid7, NSFOCUS, DAS-security, Asiainfo Security, Hillstone Networks, Dptech, etc. The top five manufacturers account for approximately 13% of the market share. Tier 1 players, led by Palo Alto Networks, Cisco, IBM, Fortinet, and Check Point, dominate the cybersecurity
Jul 13, 2026 · via openpr.com
Madison County Board of Supervisors discusses possible cybersecurity attack The Madison County Board of Supervisors voted to refer a possible cybersecurity attack involving security cameras to state authorities during a special meeting The Madison County Board of Supervisors voted to refer a possible cybersecurity attack involving security cameras to state authorities during a special meeting The Madison County Board of Supervisors voted to refer a possible cybersecurity attack involving security cameras to state authorities during a special meeting The Madison County Board of Supervisors revealed during a special meeting Thursday morning that they were part of a "cybersecurity attack." The board voted 2-1 to refer the matter to the Iowa Division of Criminal Investigation (DCI) and the attorney general's office. This follows the board's decision in March to outsource its IT department. The Madison County Sheriff's Office said the issue involves access to security cameras. According to the meeting agenda, the board had planned to motion for a closed session to discuss the matter. However, they ultimately decided not to enter a closed session. Madison County Board Supervisor Diane Fitch confirms with KCCI that the sheriff or county attorney had been contacted about a breach by their IT service. Both the DCI and the attorney general's office said they have not yet received a complaint regarding the issue. KCCI has reached out to the other two board members, Heather Stancil and Jessica Hobbs, for further details on the breach. No response has been received so far.
Jul 13, 2026 · via kcci.com
🚀 CloudSEK becomes first Indian origin cybersecurity company to receive investment from US state fund Read more An attack graph is a model that maps how an attacker could move through a network, showing the systems, vulnerabilities, and paths that connect an entry point to a critical asset. Attack graphs help security teams predict and disrupt attack paths before execution. The shift toward this approach is well documented. Gartner introduced continuous threat exposure management in 2022 and predicts that organizations prioritizing it will be three times less likely to suffer a breach by 2026. Attack graphs sit at the center of that shift, turning isolated vulnerability lists into the connected attack paths an attacker would actually follow. This guide explains what attack graphs are, the components that make them up, and how they work. It covers attack graphs versus attack trees and attack paths, the main types, how to build one, the benefits, use cases, best practices, and the limitations to plan around. An attack graph is a graphical model of the routes an attacker could take through an environment to reach a target. Nodes represent systems, conditions, or vulnerabilities, and edges represent the exploits or actions that move an attacker from one state to the next. The graph turns a list of separate weaknesses into a connected map of how those weaknesses chain together. Attack graphs answer a question that vulnerability scans cannot. A scan reports which flaws exist, while an attack graph shows which flaws sit on a path to something that matters. That distinction lets teams focus on the exposures that actually lead to a breach. Four traits define an attack graph: An attack graph is built from five components: These components combine into a working model: nodes and edges form the structure, while state information, attack
Jul 13, 2026 · via cloudsek.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
Jul 13, 2026 · via youtube.com
CYBERSECURITY Readiness Pivotal as CMMC Assessor Capacity Squeezed By Tabitha Reeves iStock illustration As Nov. 10 ushers in a new round of Cybersecurity Maturity Model Certification requirements, third-party assessors have a straight-forward message for defense contractors seeking Level 2 certification — be prepared. While Level 1 and some Level 2 contracts allow for self-assessments, achieving Level 2 certification often requires an official review provided by a CMMC third-party assessment organization, or C3PAO. Companies might feel an urgency to pencil in an official assessment in the calendar as soon as possible, but ensuring readiness beforehand is a must, executives at cybersecurity firms said. Depending on a company’s complexity and resources, achieving Level 2 can take a year or more, said Vince Scott, founder and CEO of Defense Cybersecurity Group. “Even the longest journey starts with the first step,” Scott said during a panel hosted by the National Defense Industrial Association. “If you have not started yet, you’re probably already in the window of seeing a lack of certification impact your ability to win contracts. You want to narrow that window as much as possible.” The Defense Department’s CMMC final rule that took effect in November stated that it ultimately expects roughly 118,000 organizations to need Level 2 certification, noted Logan Therrien, chief strategy officer at Kieri Solutions. By comparison, Therrien’s latest estimate for Level 2-certified companies came to just over 1,100, indicating a sizable group yet to complete the process. C3PAOs are likely to become a bottleneck for Level 2 credentials. Kieri Solutions, for example, can conduct a maximum of about 250 assessments per year, “and that doesn’t begin to make a dent in the total number,” he said during the panel. “I’m afraid not everybody who wants to get certified can get certified in October this year,” Scott said. “There’s
Jul 13, 2026 · via nationaldefensemagazine.org
KT invested 127.6 billion won in information security during fiscal year 2025, maintaining annual cybersecurity spending above 100 billion won for the fourth consecutive year, the company said on July 8. The investment ranked third among all Korean companies and was the largest among domestic telecommunications operators. KT also said it is strengthening both investment and expertise, with more than half of its dedicated cybersecurity workforce consisting of in-house specialists. The company has 317 employees dedicated to information security, including 164 internal security professionals. KT is also building a long-term talent development system for cybersecurity professionals. The company operates a customized security academy for information technology (IT) and network developers and is working with Seoul National University to establish a contract-based academic program specializing in information security. Through these initiatives, KT aims to cultivate cybersecurity talent and strengthen its internal expertise. To mark Information Security Day, KT is running an internal "Secure Together" Information Security Week campaign throughout July. The program is designed to make cybersecurity part of the company's workplace culture rather than simply a set of compliance requirements, encouraging employees to incorporate security practices into their daily work. KT is also overhauling its overall security framework based on recommendations issued last year by a joint public-private investigation team. The company said it has established a comprehensive information security master plan to revamp its management system, strengthen cybersecurity governance and asset—including supply chain—management, and develop a security framework tailored to KT's operating environment. In addition, KT is continuing its transition from a response-oriented security model to a prevention-focused approach by expanding a Zero Trust-based proactive security framework and advancing artificial intelligence (AI)-based security technologies. The company has also strengthened its personal data protection governance by launching a Personal Information Protection Advisory Committee. KT recently announced plans to invest approximately
Jul 13, 2026 · via thelec.net