For me, cybersecurity can seem small. Beyond my community of friends and colleagues, all I can see is a cyber world that is a mirrored reflection of a reflection of repeated activities. Attack. Defend. Analyze. Adapt. Attack. Defend. Analyze. Adapt. While the attackers are generally conceived as US foreign adversaries(1), the rest of the cycle…
In today’s interconnected business landscape, organizations heavily rely on third-party vendors to support various aspects of their operations. However, concerns about cybersecurity and the potential risks associated with these partnerships have become increasingly prevalent. To shed light on the true state of cybersecurity in business-to-business (B2B) relationships, a study titled Balancing Third-Party Risk: How Good…
In today’s interconnected business landscape, organizations heavily rely on third-party vendors to support various aspects of their operations. However, concerns about cybersecurity and the potential risks associated with these partnerships have become increasingly prevalent. Our new collaborative report titled Balancing Third-Party Risk: How Good Is The Company You Keep? with RiskRecon delves into this critical…
Our team just returned from SiRAcon ’23 where the conference theme was “Measuring Extremes.” If you’re unfamiliar with SiRAcon, it’s an annual event organized by the Society of Information Risk Analysts, featuring speakers and networking opportunities for information risk enthusiasts of all stripes. One of the sessions we led focused on Tail Value at Risk…
We at Cyentia Institute had the opportunity to analyze data from millions of attack path assessments conducted by XM Cyber over the last year. I’d like to share a chart from the report we published from that analysis because it touches on a theme I love exploring in cybersecurity management: prioritizing remediation. Choke Points: From…
Organizations face a never-ending game of whack-a-mole with cybersecurity. The sheer volume of security exposures is overwhelming for most security programs. XM Cyber and Cyentia Institute partner for Navigating the Paths of Risk: The State of Exposure Management in 2023 to analyze how organizations can more effectively focus their risk management on critical assets leading to exposures….
“You know when you make a copy of a copy, it’s not as sharp as the original.” – Doug Kinney (Michael Keaton), Multiplicity Cyentia recently released our second report in collaboration with SecurityScorecard titled “Close Encounters of the Third (and Fourth) Party Kind.” Yeah, yeah – I know that’s an obvious tee-up for a quote…
Elevate Security has released its 3rd User Risk research study, conducted in partnership with the Cyentia Institute, titled “High Risk Users and Where to Find Them.” The study examines eight years of Elevate User Risk data from 2014 to 2022. It found that approximately 10% of the worker population represents High Risk users, distributed across…
What are the most common strains of ransomware over the last few years? Which strains are demanding (and receiving) the highest ransoms? How do the most “successful” ransomware groups infiltrate their victims? What techniques do they use to spread around the network? How (and how often) is data exfiltrated in addition to being encrypted? And…
While working on volume 2 of the Investigative Cybercrime Series, Reining In Ransomware, we were curious about the functionality of the most common ransomware strains. The thinking went like this: if we can identify what they do, then we can use the frequency info from actual cases to weight those actions and find key protections…