UPDATE: After 10 years, the Library was taken offline in early 2026 due to insufficient funding. Thanks to all those who used it over the years. We regret not being able to continue supporting this community resource. We launched the Cyentia Industry Research Library to curate cybersecurity industry reports, making them more accessible and useful…
It has been a while since my last (and first real) post. We’ve been busy, and so, in the interest of getting back into the swing of blogging I’d like to talk about a fun bit of analysis on application security we did in a fresh off the presses report. In our latest collaboration with…
In collaboration with Siemplify, the Cyentia Institute recently released the Road to Security Operations Maturity study. It’s been a couple of years since we visited the topic of SecOps, so it was fun to get back into it during this project. As the name implies, the focus of this study was understanding where SecOps programs…
This week Cyentia partnered with RiskRecon to cover the Risk Surface Report. This is the first report in a series covering organizational and third (and fourth and…) party risk. The report lays out risk landscape across a number of different dimensions. You should go read it right now! But here I want to talk about…
Pile on the data “Here’s a link to the data, we need to have something before RSAC, which gives us about… four weeks”. That’s four weeks to process 40GBs of data, inconveniently a little bigger than fits into my laptops memory. Four weeks to establish a few interesting research questions, understand whether the data can…
The Prioritization to Prediction report series is an ongoing research initiative between Kenna Security and the Cyentia Institute. The first volume proposed a model for predicting which of the numerous hardware and software vulnerabilities published each month were most likely to be exploited, and thus deserving of priority remediation. The second volume sought to apply…
Last Thursday, Veracode released their 9th State of Software Security (SOSS) report, and we here at Cyentia were fortunate to be able to help out with the research this year. The primary data that Veracode has to work with is findings from source code analysis. But what really makes this data valuable is that the…
An Inside Perspective on Security Operations We are thrilled to announce the culmination of a project we’ve been working on for some time. The Voice of the Analyst Study released today and we’d like to share a few findings with the hope of stoking your interest enough to read the full report. First off, our thanks…
Mining for Insight in a decade’s worth of RSA Conference Abstracts Imagine for a moment that you had access to 15,000 Call-for-Paper (CFP) abstracts from ten years of the largest cybersecurity conference in the world — what would you want to know? Well, that’s exactly the position we found ourselves in when the RSA Conference…
I’ll be honest, I have a love/hate relationship with confidence intervals. On one hand, they are indispensable — confidence intervals put a (quantified) frame around outcomes and helps us understand the “strength” of our observations. On the other hand, they can be just plain confusing and may create more confusion for many readers. Explaining why…