Hey, you got multi-party incidents in my extreme events! You got extreme events in my multi-party incidents! Here at Cyentia, we love cooking up analysis of cyber incidents in the service of better risk decisions. We’ve explored multi-party incidents (Ripples Across the Risk Surface) and extreme events (IRIS Xtreme) before. It’s only natural to wonder…
Hey, you got multi-party incidents in my extreme events! You got extreme events in my multi-party incidents! Here at Cyentia, we love cooking up analysis of cyber incidents in the service of better risk decisions. We’ve explored multi-party incidents (Ripples Across the Risk Surface) and extreme events (IRIS Xtreme) before. It’s only natural to wonder…
One of the many lessons that COVID-19 has to offer information security practitioners is a fresh appreciation of the importance of supply chains and the pain that occurs when previously taken-for-granted connections are attacked. Last month we released Ripples Across the Risk Surface, our latest report in partnership with RiskRecon. In this report, we explore…
Back in early January (six months ago), I wrote a blog post about the rise of GitHub as a source for published vulnerability exploits. Since then, we’ve launched our Exploit Intelligence Service (EIS), where we aggregate not just GitHub exploits but references to other exploits as well. In this post, I am looking into how…
Nope; that’s not a misspelling. Perhaps we’ll fully solve the persistent problem of human risk in cybersecurity one day, but until then, we’re forced to find ways to salve its effects. And since humans are complicated, that task is also complicated. Which is why I’m pleased to see a company like Elevate Security using a…
We released the Cyentia Cybersecurity Research Library over 3.5 years ago with the goal of curating existing industry knowledge to make it more accessible and useful for the community. I’m very proud of the work our team has done since then to make that goal a reality. Here’s a sampling of those accomplishments: Upon introduction,…
If you’ve been in the infosec industry for at least 10 years, you might remember a hubbub in 2010 over someone dubbing security researchers “Narcissistic Vulnerability Pimps” or NVPs. Confession time…that was me. At that time, part of my job was keeping customers informed about developments that altered their cyber risk posture, and I was,…
One of the key things we’ve learned researching the vulnerability landscape is that there is a strong relationship between publicly available exploit code and actually seeing an exploit used in the wild. We noticed way back in 2018 that vulnerabilities with published exploit code are as much as 7 times as likely to be exploited…
You’ve probably heard the phrase “Nature vs. Nurture” at some point; it’s one of the oldest topics of debate in psychology circles. In a nutshell, the debate centers on whether who you are is defined by what you’re born with (genes) or by how you’re raised (environment). We can all think of personality quirks we’ve…
Bottom line up front: The Security Outcomes Study – our first collaboration with Cisco – just hit the shelves. We surveyed over 4,800 IT and security professionals to measure the increase in probability of (reported) success along several security program outcomes associated with strong (reported) adherence to various security practices. In other words, what actually…