B2i Digital, Inc. From Carbon Credits to Cybersecurity: Twelve Companies Present at the June 4 Small Cap Growth Virtual Investor Conference | B2i Digital, Inc. / Key word(s): Financial Advanced Materials, Cybersecurity, Clean Fuels, Diagnostics, Public Safety Technology, and More on the Agenda Direct Access to Management Teams Through Live Presentations, Real-Time Q&A, and One-on-One Meetings NEW YORK, NY – May 29, 2026 (NEWMEDIAWIRE) – B2i Digital, Inc. invites investors to the Small Cap Growth Virtual Investor Conference on June 4, 2026. B2i Digital is the Official Marketing Partner, supporting the conference through digital marketing, social media, and company profiles. Twelve public companies will present. The lineup spans advanced materials, cybersecurity, climate solutions, restaurants and hospitality, clean fuels, electronic components, diagnostics, industrial nanotechnology, public safety technology, renewable power, oil and gas, and wireless technology. Each company has 30 minutes for a live presentation and Q&A. One-on-one meeting requests are available through the VIC site, with replays available on B2i Digital and OTC Markets YouTube channels. “You won’t find a graphene maker, a carbon-credit trader, a synthetic jet fuel developer, and a national restaurant operator on the same conference agenda anywhere else. That mix keeps investors watching all day and minimizes the caffeine needed to stay awake between presenters. When VIC runs a sector-agnostic event the presenting slots sell out, and a full agenda draws the crowd,” said David Shapiro, Chief Executive Officer of B2i Digital. The conference is co-sponsored by Skyline Corporate Communications Group, LLC, a corporate communications and investor relations firm that works with public companies and issuers preparing to go public. Skyline’s team brings deep capital markets experience to the companies it serves, helping management tell their story clearly and reach the right investors. “Our objective is to showcase high growth, innovative companies in front of the people
May 29, 2026 · via eqs-news.com
From Carbon Credits to Cybersecurity: Twelve Companies Present at the June 4 Small Cap Growth Virtual Investor Conference Advanced Materials, Cybersecurity, Clean Fuels, Diagnostics, Public Safety Technology, and More on the Agenda Direct Access to Management Teams Through Live Presentations, Real-Time Q&A, and One-on-One Meetings NEW YORK, NY - May 29, 2026 (NEWMEDIAWIRE) - B2i Digital, Inc. invites investors to the Small Cap Growth Virtual Investor Conference on June 4, 2026. B2i Digital is the Official Marketing Partner, supporting the conference through digital marketing, social media, and company profiles. Twelve public companies will present. The lineup spans advanced materials, cybersecurity, climate solutions, restaurants and hospitality, clean fuels, electronic components, diagnostics, industrial nanotechnology, public safety technology, renewable power, oil and gas, and wireless technology. Each company has 30 minutes for a live presentation and Q&A. One-on-one meeting requests are available through the VIC site, with replays available on B2i Digital and OTC Markets YouTube channels. “You won’t find a graphene maker, a carbon-credit trader, a synthetic jet fuel developer, and a national restaurant operator on the same conference agenda anywhere else. That mix keeps investors watching all day and minimizes the caffeine needed to stay awake between presenters. When VIC runs a sector-agnostic event the presenting slots sell out, and a full agenda draws the crowd,” said David Shapiro, Chief Executive Officer of B2i Digital. The conference is co-sponsored by Skyline Corporate Communications Group, LLC, a corporate communications and investor relations firm that works with public companies and issuers preparing to go public. Skyline’s team brings deep capital markets experience to the companies it serves, helping management tell their story clearly and reach the right investors. “Our objective is to showcase high growth, innovative companies in front of the people who would want to understand and learn about them, and a
May 29, 2026 · via newmediawire.com
Michigan House Bill 6011 was introduced last Thursday, and it would require operators of solar energy facilities to create and implement cybersecurity measures. According to the bill, operators of qualifying solar facilities would be required to maintain "reasonable security measures" to protect "safety-critical systems" from cyber attacks that could impair safe operations. The bill requires operators to implement a risk-based cybersecurity and resilience program aligned with recognized standards such as guidance from either the National Institute of Standards and Technology or the Cybersecurity and Infrastructure Security Agency. The cybersecurity program may include cyber risk identification, access controls, network/system segmentation, supply-chain risk management and periodic review and testing. Operators would also have to maintain an incident response plan that coordinates with emergency responders. However, the bill states that these notifications do not impose new duties or liabilities on emergency responders. If a cybersecurity incident were to happen, for a "material cybersecurity incident," operators must notify the Michigan State Police and the local emergency management coordinator within 24 hours of discovery, when practicable. Within 72 hours, operators must provide a written high-level summary that avoids disclosing sensitive security details. The Attorney General may request documentation only when tied to a specific incident or complaint. It explicitly forbids routine or programmatic audits. The bill said that knowingly or recklessly violating the section could result in civil fines up to $25,000 per day per violation. The Attorney General would have to provide notice and up to 30 days to cure violations before seeking penalties. The bill was introduced by Representative Reggie Miller (D-District 31) and was cosponsored by four other Democrats. The bill was referred to Committee on Communications and Technology. ©2026 the Midland Daily News, Distributed by Tribune Content Agency, LLC.
May 29, 2026 · via govtech.com
Telecom cybersecurity alliance sets an example for threat intelligence sharing How shared intelligence could reshape cybersecurity across industries Key takeaways - Telecom providers are showing that cyber defense works better together than alone. - AI is compressing the timeline between vulnerability discovery and exploitation. - Real-time threat sharing helps teams respond faster and avoid reinventing the wheel. - This alliance could become a model for cross-industry cybersecurity collaboration. - As public-sector support weakens, private-sector coordination may need to fill the gap. - Fear of legal exposure still stands in the way of broader intelligence sharing. What is the C2 ISAC, and why was it created? Eight providers of telecommunications services in the U.S. are circling their cybersecurity wagons to now share threat intelligence via the next iteration of a Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC). AT&T, Charter, Comcast, Cox, Lumen Technologies, T-Mobile, Verizon, and Zayo have established C2 ISAC in the wake of cyberattacks such as the Salt Typhoon campaign successfully accessed call records and communications data. More troubling still, advances in artificial intelligence (AI) are raising concerns about software vulnerabilities that might be discovered and then exploited in a matter of hours. Rather than trying to combat these attacks independently, telecommunication providers are extending previous efforts to share threat intelligence in real time to enable them to both detect and respond to attacks faster and, ultimately, contain costs. Otherwise, each telecommunications provider winds up spending time, money and effort on replicating threat intelligence research that may have already been done elsewhere. Could this model work in other industries? The question the C2 ISAC alliance raises, of course, is to what degree might similar alliances be formed across other industry sectors or, for that matter, between organizations operating in completely different industries. The simple fact of the
May 29, 2026 · via blog.barracuda.com
Since 2006, Dark Reading has been at the forefront of covering cybersecurity, providing deep insights and analysis beyond the headlines. All those major news events? We were there. Shifts in technology trends? We wrote about them. Enjoy this special anniversary coverage celebrating where we've been and what's next. Name That Toon: Mark of (Cybersecurity) Progress As part of Dark Reading's 20th anniversary package, we asked readers for a cybersecurity-related caption that captures their thoughts about the industry's last two decades. The cybersecurity industry has undergone seismic shifts driven by wave after wave of technological transformation — from the early days of signature-based antivirus and perimeter firewalls protecting on-premises networks, through the cloud migration that dissolved those perimeters entirely, to the mobile revolution that put corporate data on devices in employees' pockets and coffee shops worldwide. And now, defenders are gearing up for the AI transformation. The Internet of Things expanded the attack surface with billions of connected devices, many with laughably weak security controls. Remote work, turbocharged by the pandemic, shattered whatever remained of the network perimeter, forcing enterprises to embrace zero-trust models where every access request is verified regardless of origin. Through it all, threat actors evolved from lone hackers to sophisticated criminal enterprises and nation-state operations, wielding zero-days and supply-chain attacks with surgical precision. Dark Reading turned 20 on May 1, and to celebrate, we brought back the Name That Toon contest. We asked readers to send us their most creative cybersecurity-related caption that describes what is happening in the cartoon. The winning caption, "Look, I know, but this was the best AI stack we could afford," comes to us by way of Prasen Shelar, co-founder and CEO of AI-startup Axari via LinkedIn. Thanks to all the readers who participated! Click here for all our DR20 content.
May 29, 2026 · via darkreading.com
orrstown financial services - Notified Of Third-Party Vendor Cybersecurity Incident On May 21, 2026
RefinitivLess than 1 min read
© Copyright Thomson Reuters 2026. Click For Restrictions - https://agency.reuters.com/en/copyright.html
Login or create a forever free account to read this news
May 29, 2026 · via tradingview.com
Getty Images/iStockphoto EO 14390 raises stakes for enterprise cybersecurity Reframing cybercrime as a national security issue, EO 14390 could lead to stronger links between government and the private sector. Find out what it means for enterprise security. For years, federal cybersecurity policy has primarily focused on protecting government systems and critical infrastructure. Executive Order 14390: "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens" signals a broader shift in emphasis. Signed on March 6, 2026, the order reframes cybercrime not only as a national security threat, but also as an economic and societal threat that directly affects citizens, businesses and the digital ecosystem on which they depend. The executive order lands amid escalating ransomware campaigns, AI-enabled fraud schemes, large-scale phishing operations and financially motivated attacks linked to transnational criminal organizations. Unlike earlier cybersecurity directives that focused heavily on federal modernization, critical infrastructure protection and software supply chain security, EO 14390 emphasizes operational disruption of cybercriminal networks, victim restitution and expanded coordination between government agencies and the private sector. For enterprise security leaders, the order does not immediately impose a new regulatory framework. However, it signals the direction of federal cyber policy, with greater emphasis on private-sector accountability, expanded information sharing, increased scrutiny of enterprise cyber practices and stronger expectations for cooperation with government-led cyberdefense initiatives. Skadden, Arps, Slate, Meagher & Flom LLP, in its legal analysis of EO 14390, said that it "is further indication that the Trump administration intends to broaden the role of the private sector in the government's offense-oriented approach to cyberthreats." In practical terms, the order raises an important question for businesses. Is cybersecurity still just an IT risk, or is it becoming a broader legal, operational and governance obligation tied directly to national resilience? A sign of the times The order was issued as the
May 29, 2026 · via techtarget.com
Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. "The campaign abused trusted endpoint management infrastructure to deliver malware across managed endpoints," Arctic Wolf said. "Threat actors disguised the credential stealer payload as a Fortinet endpoint update, silently executing the malicious executable through PowerShell." The activity, observed by the cybersecurity company in May 2026, involves the exploitation of CVE-2026-35616 (CVSS score: 9.1), a critical pre-authentication API access bypass leading to privilege escalation. The issue was addressed by Fortinet in FortiClient EMS 7.4.7 and later. A successful compromise is followed by the threat actor taking steps to modify configurations to defer firmware upgrade reminders, as well as modifying a Remote Access Profile configuration and endpoint policy to insert a malicious script for execution on endpoint devices. "The observed execution pattern suggests that threat actors used FortiClient's own management pathway to push malicious PowerShell commands to managed endpoints in a way that resembled legitimate management operations," Arctic Wolf said. "Once the threat actors had a route to modify EMS-managed configuration, every managed endpoint became a potential execution target without requiring a separate intrusion path to each device." In addition, the attack has been found to leverage "fortitray.exe," a legitimate executable associated with FortiClient to launch a .cmd script file using "cmd.exe." The .cmd script is designed to invoke a Base64-encoded PowerShell script that, in turn, is responsible for downloading a malicious payload, running it, and exfiltrating the results to "83.138.53[.]110" via an HTTP POST request. The executable, named "FortiEndpoint_Patch.exe," masquerades as an update, but, in reality, is a previously unreported Windows information stealer capable of harvesting sensitive data, such as passwords, cookies, and autofill details such as credit card information, addresses, and phone numbers, from Chromium- and Gecko-based browsers.
May 29, 2026 · via thehackernews.com
Digital Growth Is Outpacing Cybersecurity at Credit Unions. Here’s How to Close the Gap By Brad LaPorte, Chief Marketing Officer at Morphisec Simple Subscribe Subscribe Now! Digital transformation has unlocked remarkable possibilities for credit unions, including seamless mobile banking, AI-driven personalization, and hybrid member services that were unimaginable a decade ago. But this growth comes with a cost that many credit union leaders are only beginning to fully appreciate—the cybersecurity frameworks they have in place were built years ago and never designed for today’s threat environment. And the gap between their digital ambitions and the reality of their security readiness is widening fast. Reality check: The numbers tell a stark story. According to the Sophos State of Ransomware in Financial Services 2025 report, 64% of financial services organizations experienced a ransomware attack in the past year, and the mean recovery cost following a ransomware attack now sits at $1.53 million. And payment doesn’t preclude you from future attacks—80% of organizations that pay the ransom are attacked again within 12 months. For member-owned institutions where trust is the foundational currency, that kind of disruption is not just a financial hit; it’s one that could put the institution’s future at risk The Threat Landscape Has Changed. Most Defenses Have Not. Ransomware is only part of the story. Attackers are increasingly using AI to scale phishing and social engineering campaigns at a speed and sophistication that traditional defenses cannot match. IBM’s X-Force Threat Intelligence Index reported an 84% year-over-year increase in infostealing malware designed to steal credentials and bypass conventional security tools. In early 2025, the increase reached 180%. What is becoming clear is that the same AI tools credit unions are adopting to improve fraud detection and member experience are being weaponized by adversaries to evade the security controls protecting those very
May 29, 2026 · via thefinancialbrand.com
The UAE Cybersecurity Council has entered into a landmark partnership with QuantumGate to launch the national Crypto Discovery Tool (CDT). Engineered in Abu Dhabi and meticulously customized to the rigorous mandates of the UAE National Cryptography Center, this pioneering solution solidifies the nation’s trajectory toward an ironclad, quantum-safe future. By integrating deep tech innovation with sovereign defense strategies, this elite collaboration establishes the UAE as a leader in the global race to operationalize large-scale, post-quantum migration frameworks across critical national infrastructure. Operationalising Strategic Control and Absolute Visibility At the core of this enterprise-grade deployment is a definitive mandate: organizations cannot defend what they cannot see. The Crypto Discovery Tool empowers critical public and private sector entities with comprehensive, end-to-end visibility across dense and complex digital ecosystems. By automating the discovery of embedded cryptography and providing an exhaustive inventory of cryptographic assets, the CDT translates macro national ambitions into granular operational readiness. This unparalleled visibility ensures that decision-makers can proactively mitigate cryptographic vulnerabilities long before quantum threats disrupt market stability. Key Pillars of the National Crypto Discovery Tool To guarantee continuous protection and regulatory agility, the tool is built upon an advanced, enterprise-focused operational architecture: - Automated Asset Mapping: Eliminates blind spots by generating an active, real-time map of all hidden and embedded cryptographic infrastructure. - Agile Risk Management: Provides a structured, risk-aware blueprint to systematically harden legacy encryption and direct migration paths. - Modular Compliance Engine: Designed to evolve alongside emerging cybersecurity directives, ensuring organizations remain structurally audit-ready. Continuous Monitoring and Ecosystem Integration Beyond immediate vulnerability discovery, the CDT introduces sophisticated continuous monitoring capabilities. This persistent oversight feeds cryptographic posture data directly into the UAE’s broader security network via the National Cybersecurity Index platform. By centralizing reporting data, the tool powers the newly established UAE National PQC Index, equipping the
May 29, 2026 · via intlbm.com
Gov't announces measures to strengthen private sector cybersecurity response systems Published: 29 May. 2026, 13:43 The government announced on Friday a series of measures to strengthen its private sector cybersecurity response systems. The plan was unveiled at the ninth meeting of science and technology ministers amid rapid advances being made in the AI sector, which has drastically accelerated the discovery and weaponization of software vulnerabilities, the Ministry of Science and ICT said. Under the plan, the government will establish an emergency system under the Office of National Security. The system will use AI to detect software vulnerabilities, patch them and jointly respond to digital security breaches. The government will also create a vulnerability management center under the Korea Internet & Security Agency, which will take charge of vulnerability detection and patching. In the private sector, the government will monitor the cybersecurity readiness of approximately 1,200 major companies in critical industries, including the finance and medical fields. For smaller firms, it plans to provide technical support, such as web tools, to help enhance their cybersecurity capabilities. The government also plans to expand cooperation with major tech companies, including its recent partnership with OpenAI, and related agencies in friendly nations for digital defense response and information sharing. Korea aims to transform its cybersecurity system into one based on homegrown AI technologies starting in 2027 and execute various projects aimed at establishing AI security sovereignty, the Science Ministry added. Yonhap with the Korea JoongAng Daily To write comments, please log in to one of the accounts. Standards Board Policy (0/250자)
May 29, 2026 · via koreajoongangdaily.joins.com
The cybersecurity community is blasting Microsoft for threatening legal action against a disgruntled researcher who’s been exposing Windows vulnerabilities outside the company’s normal disclosure process. The controversy deals with a researcher known as “Nightmare Eclipse,” who has published six unpatched “zero-day” flaws in recent weeks. This includes a proof-of-concept exploit for a Windows vulnerability known as BlueHammer that can allow an attacker to escalate their privileges to the administrator level. Researchers normally submit such findings to the Microsoft Security Response Center (MSRC) for patching to prevent hackers from exploiting them. But Nightmare Eclipse has deliberately ignored the responsible disclosure route, citing claims that Microsoft mistreated them. “They mopped the floor with me and pulled every childish game they could,” the researcher wrote last month, without elaborating. “It was soo bad at some point I was wondering if I was dealing with a massive corporation or someone who is just having fun seeing me suffer but it seems to be a collective decision.” The tension only escalated after Nightmare Eclipse disclosed more flaws this month, writing: “Microsoft has chosen to make this worst instead of resolving the situation like adults, they pulled every childish game possible.” On Wednesday, the software giant responded with its own blog post that reiterated the need for responsible disclosure to prevent hackers from abusing such flaws and contained a legal threat. “Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable and have real-world consequences,” the company wrote, later adding: “Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity – coordinating as needed with law enforcement around the world.” Microsoft goes on to say “any disclosure outside proper coordination” could harm its customers. But that last part about pursuing
May 29, 2026 · via pcmag.com
AMSTERDAM — One of the big topics, especially in light of the SpaceX initial IPO documents, is the future of orbital data centers and the possibilities of moving compute to space. Experts at SmallSat Europe tried to decipher between the hype and reality of orbital data centers — in terms of both technology and economics. Dr. Paul Struhsaker, CEO of engineering and technology consulting firm Arrasar Partners, who formerly worked as a corporate vice president at semiconductor company AMD. He described the buzz as a reaction to terrestrial challenges. “There are a lot of constraints [to putting data centers on Earth],” Struhsaker said. “Then you have the question — Why don’t we put them all in space? Here, there is unlimited energy, for example. However, you need custom silicon to put data centers in space.” There a number of players beginning to emerge in this space with the likes of SpaceX, Starcloud, Blue Origin’s Project Sunrise, Google with Planet Lab, in addition to Sophia Space, Axiom Space, Aetherflux, and others. While Struhsaker said he understands the logic behind these moves, there are a number of issues that will need to be addressed. He spoke of the level of compute that players want to put in orbit will be “orders of magnitude more than the constellations we have now.” In addition, the way processors and chips go through iteration will create a new set of problems. “An AI data center blade lifespan is five years. AI has made this even worse. Instead of a five-year span, the next generation of processors come out every two years … we’re now shortening the lives of the hardware in the data center. That creates a lifespan issue for satellites in orbit.” Compute lifespan and replacement is a significant logistics issue, which will also bring
May 29, 2026 · via satellitetoday.com
For over a decade, the default enterprise infrastructure strategy was simple: migrating as much as possible to the cloud. Today, however, this ‘cloud-first’ mandate is no longer adequate for modern security and business demands. Today’s CISOs and CIOs are dealing with a complex threat landscape defined by accelerating AI adoption, geopolitical conflict, fragile supply chains, data sovereignty mandates, sophisticated identity-driven attacks, and intense cost scrutiny. In addition, for numerous organizations, the era of unbridled cloud expansion is colliding with harsh economic realities, as escalating outbound data transfer charges and cloud storage fees, fragmented provisioning, and vendor lock-in erode the cloud’s initial value proposition. Although the public cloud offers unparalleled velocity for startups, more mature, steady-state workloads often face unforeseen financial burdens. Cloud investment was originally supposed to deliver efficiency, but 69% of CFOs now believe that between 10% to 30% of cloud spending is wasted. For today’s enterprise, the goal has shifted from being “cloud-first” to “control-first.” The Control-First Placement Strategy A control-first approach doesn’t mean abandoning the public cloud entirely. Instead, it demands a strategic, nuanced decision on where to place each workload to achieve the optimal balance of risk reduction, cost efficiency, performance, resilience, and governance. This may mean repatriating critical workloads to hybrid, private, edge, or on-premises environments. Public cloud repatriation, the movement of workloads from public cloud environments back to private infrastructure or alternative hosting providers, has become one of the most discussed trends in enterprise IT. The real discussion now focuses on placement strategy. Where should AI workloads run for the best balance of performance, cost, governance, and resilience? This is why hybrid cloud has moved from being a transitional architecture to becoming the preferred operating model for AI-driven enterprises. New Security Requirements Drive Infrastructure Decisions The World Economic Forum’s 2026 cybersecurity outlook points to
May 29, 2026 · via cybersecurity-insiders.com
Colorado cybersecurity office announces mass layoffs following scathing audits The Colorado office responsible for overseeing the state's cybersecurity and digital infrastructure announced sweeping layoffs and a major restructuring effort this week following years of blistering state audits that exposed serious security deficiencies. The Colorado Office of Information Technology said on Wednesday it is eliminating 173 positions, which is roughly 16% of its workforce. Leaders are calling it a "transformational change" aimed at modernizing the agency and strengthening the state's cyber defenses. The office oversees a wide range of digital services used by Coloradans every day, including unemployment benefits, workers' compensation systems, driver's licenses and food assistance programs. But in recent years, the agency has come under intense scrutiny after multiple state audits uncovered dozens of vulnerabilities that auditors warned could leave Colorado at risk of a major cybersecurity breach. The office has been the subject of four audits in recent years. Those reviews identified deficiencies in areas including contingency planning, incident response, and risk management. "We have to recognize the threat is getting a lot bigger," said David Edinger, the office's outgoing CEO and executive director. "We've got to get a lot more mature fast." Edinger said incremental fixes would no longer be enough to address the agency's problems. "Tweaks won't cut it," he said, describing the restructuring as necessary to overhaul outdated systems and practices. Edinger is among the employees leaving the agency during the restructuring. Sarah Tuneberg, the state's new chief information officer, said the office must fundamentally rethink how it operates in order to meet modern cybersecurity challenges. "We're radically transforming the way we think about things to be the modern technology organization, like Google, like Microsoft, like Spotify," Tuneberg said. State lawmakers who have closely monitored the office say the changes are overdue. State Rep. Brianna
May 29, 2026 · via cbsnews.com
Why AI Cybersecurity Programs Are More Important Than Ever AI has opened up many doors for businesses and individuals alike, but those open doors sometimes let bad actors follow close behind. AI systems, programs, and platforms are perhaps some of the most transformative tools to have entered mainstream industries in the past five years. As useful as many AI tools have been, however, they’ve also introduced or otherwise exacerbated several problems, with one of the most important being security. This issue has necessitated the development of AI security measures. What is AI Security? AI security doesn’t refer to a single program or practice, but instead a series of processes designed to work in conjunction with each other to limit unauthorized access to an organization’s AI systems, data pipelines, models, users, permissions, cloud infrastructure, and connected applications. Though many of these processes incorporate AI in some way, some benefit from human oversight and intervention. For example, while an organization may use AI to improve their threat detection and incident response programs, they may still rely on a cybersecurity team to actually address the issues those programs flag. Ultimately, both AI and security experts work together to enhance an organization’s security posture by minimizing its exposure to external and internal threats. How a given security team approaches this may differ depending on the tools they have available to them and the amount of data they need to protect; a healthcare enterprise tasked with keeping patient records safe will likely invest more in AI security than a small bakery, for instance. How AI Security Works to Keep Sensitive Data Safe Given how many industries have adopted AI to some degree—customer service, software development, document review, marketing—AI security has become as much of a business governance issue as it is a response to technical
May 28, 2026 · via desmoinesregister.com
Most cybersecurity professionals have higher confidence in CISOs if they have experienced a major cyber-attack or cybersecurity incident, an industry poll has revealed. Published by cybersecurity certification body ISC2, the research asked 796 people working in cybersecurity for their views about their cybersecurity leadership. Over three quarters of those agreed that a cybersecurity leader’s credibility is enhanced if they have already been in charge during a real, high-profile security incident. Overall, 35% said they “strongly agree” and a further 41% said they “somewhat agree.” Under one in ten said they didn’t agree. The outcome or potential blame around the previous cyber incident does not seem to play a role in the trust in the cybersecurity leader, only that the experience they had during the incident mattered. “Leading through a major cybersecurity incident can build credibility because it gives leaders practical experience, perspective and the ability to stay composed under pressure,” Scott Beale, CEO of ISC2 told Infosecurity. “These findings suggest cybersecurity professionals value leaders who can apply those lessons to make better decisions, communicate with clarity and strengthen resilience across the organization,” he added. What Good Cybersecurity Leadership Looks Like When asked whether technical hands-on experience or strategic and executive leadership experience were more valuable in a cybersecurity leader, the majority of respondents (71%) said that it was important for them to have both. However, of those who preferred one over the other, 18% said that cybersecurity leaders should have strong strategic and executive leadership experience. Read more: Five Critical Skills for the Modern Day CISO Many commented that strong leadership traits such as the ability to drive teams through high-stress situations, business acumen and the ability to articulate complex ideas and technologies in simple business-oriented terms were essential for the role. Just 11% said extensive hands-on technical or incident
May 28, 2026 · via infosecurity-magazine.com
Discover how security leadership can help small businesses improve cybersecurity decision-making, clarify responsibilities, and prepare for cyber incidents. Security leadership is not always about building a full cybersecurity department. It is about establishing clear responsibility for cyber-related decisions when issues arise or are identified. Key Takeaways: - Small businesses should consider designating a clear owner for cybersecurity-related decisions, even if that person is not a technical specialist. - Security leadership can help turn scattered tools and good intentions into clearer priorities, defined roles, and a coordinated response plan. - Basic cybersecurity measures such as multi-factor authentication, backups, employee training, vendor checks, and incident planning, can make a meaningful difference. - Your bookkeeper gets an urgent email that looks like it came from you. A vendor portal asks for a password reset. An employee’s laptop starts acting strange right before payroll. Who decides what happens next? For many small businesses, the honest answer might be “whoever notices first.” That approach may become more difficult when customer data, payroll, or operations are impacted. Security leadership provides a dedicated owner to establish a plan before employees make uninformed calls under pressure. Someone has to own the security decisions. You do not necessarily need a Chief Information Security Officer to take cybersecurity seriously. But, you should consider a designated person who can help ensure security responsibilities do not fall between the cracks. That person might be the owner, an operations manager, an IT lead, an office manager, or an outside managed IT or security partner. The title matters less than the job. Someone should know which systems matter most, who has access, how backups work, who to call during an incident, and which risks need attention first. This is also where cybersecurity has shifted. When NIST released Cybersecurity Framework 2.0 in 2024, it added
May 28, 2026 · via acrisure.com
A new bill was introduced in the Michigan House of Representatives that would add new cybersecurity requirements for solar farms. Michigan House Bill 6011 was introduced last Thursday, and it would require operators of solar energy facilities to create and implement cybersecurity measures. Advertisement Article continues below this ad According to the bill, operators of qualifying solar facilities would be required to maintain “reasonable security measures” to protect “safety-critical systems” from cyberattacks that could impair safe operations. The bill requires operators to implement a risk-based cybersecurity and resilience program aligned with recognized standards such as guidance from either the National Institute of Standards and Technology or the Cybersecurity and Infrastructure Security Agency. The cybersecurity program may include cyber risk identification, access controls, network/system segmentation, supply-chain risk management and periodic review and testing. Operators would also have to maintain an incident response plan that coordinates with emergency responders. However, the bill states that these notifications do not impose new duties or liabilities on emergency responders. If a cybersecurity incident were to happen, for a “material cybersecurity incident,” operators must notify the Michigan State Police and the local emergency management coordinator within 24 hours of discovery, when practicable. Advertisement Article continues below this ad Within 72 hours, operators must provide a written high-level summary that avoids disclosing sensitive security details. The Attorney General may request documentation only when tied to a specific incident or complaint. It explicitly forbids routine or programmatic audits. The bill said that knowingly or recklessly violating the section could result in civil fines up to $25,000 per day per violation. The Attorney General would have to provide notice and up to 30 days to cure violations before seeking penalties. Advertisement Article continues below this ad The bill was introduced by Representative Reggie Miller (D-District 31) and was cosponsored
May 28, 2026 · via michigansthumb.com
Hottest cybersecurity open-source tools of the month: May 2026 Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. Pipelock: Open-source AI agent firewall AI coding agents run with shell access, environment variables containing API keys, and unrestricted internet connectivity, creating a single point of failure where one compromised tool call can leak credentials to an attacker-controlled domain. Pipelock, an open-source security harness developed by Joshua Waldrep under the PipeLab project, addresses this exposure by inserting an enforcement layer between agents and the network. Version 2.3.0 shipped with class-preserving request redaction and generic SSE streaming response scanning. AIMap: Open-source tool finds and tests exposed AI endpoints Public-facing Ollama servers, MCP endpoints, and inference proxies have multiplied across the internet over the past year, often deployed without authentication or rate limits. AIMap is an open-source platform that finds these systems at internet scale, fingerprints them, scores their exposure, and runs protocol-specific attack tests against authorized targets. Rustinel: Open-source endpoint detection for Windows and Linux Open-source endpoint detection has long been split between Windows-focused tools built around Sysmon and Linux tools built around eBPF or auditd. Defenders running mixed environments have had to stitch together separate pipelines, separate rule sets, and separate maintenance burdens. Rustinel, a Rust-based endpoint agent, is an attempt to collapse that work into a single codebase. Sandyaa: Open-source autonomous security bug hunter Source code auditing has traditionally relied on static analyzers that flag long lists of potential issues, leaving engineers to sort bugs from noise. A new open-source project from offensive-security firm SecureLayer7 takes a different route, using LLMs to read a codebase, trace how data moves through it, and produce working exploit code for the vulnerabilities it confirms. Their open-source tool, called
May 28, 2026 · via helpnetsecurity.com