Author: bacohido

The rise of AI co-pilots is exposing a critical security gap: sensitive data sprawl and excessive access permissions.

Related: Weaponizing Microsoft’s co-pilot

Until now, lackluster enterprise search capabilities kept many security risks in check—employees simply couldn’t find much of the data they were authorized to access.

But Microsoft Copilot changes the game, turbocharging enterprise search and surfacing sensitive information that organizations didn’t realize was exposed.

Many assume Copilot won’t share data externally and will respect existing user permissions, leading to a false sense of security. But the real problem isn’t whether Copilot stays within its lane—it’s that the lane is far too wide. If employees already have excessive access, Copilot simply makes that exposure more visible.

Patchwork fixes fall short

This reality is hitting hard. A recent Gartner survey found that 40% of IT managers have delayed Copilot deployments due to security concerns. I’ve spoken with numerous CIOs and CISOs who say these issues are directly impacting rollout plans at major enterprises.

Alkove

Microsoft’s response? Instead of pushing organizations toward a true “least privilege” model, it suggests running limited Copilot trials to see what data gets exposed. That’s a band-aid solution, not a fix.

Copilot isn’t the problem—it just amplifies an existing one. The real issue is the outdated, over-permissioned access models that have plagued enterprises for years.

Over-provisioned access

The risks of excessive access are nothing new. Identity-related issues have become the leading driver of security breaches in recent years. But many organizations still lack modern tools to manage access effectively.

Consider this: most organizations can’t answer basic questions about their own data security, including:

•Who has access to what?

•Where did they get it?

•How are they using it?

•Should they even have it?

The problem stems from legacy IAM systems and manual, piecemeal processes—entirely inadequate for today’s decentralized cloud, SaaS sprawl, and AI-driven environments.

AI’s promise vs. risk

AI thrives on data, but that same data introduces risk. One of the biggest threats isn’t AI itself—it’s the over-provisioned access policies that leave organizations vulnerable. Microsoft’s own data shows that 95% of granted permissions go unused. That’s the opposite of least privilege.

Efforts to classify and restrict sensitive data help, but they don’t address the underlying issue: employees having more access than they need in the first place.

Despite these risks, businesses are rapidly adopting AI, with privacy and security top of mind for leadership. Yet, without a fundamental shift in access management, organizations will continue exposing themselves to unnecessary threats.

Securing AI going forward

It’s time for organizations to move beyond the “check-the-box” approach to access security. Implementing a true least privilege model—where employees only have access to the data they actually need—isn’t optional anymore. It’s a necessity.

Modern IAM solutions must provide visibility, intelligence, and automation to restructure permissions and monitor AI-driven activity. Without these foundational steps, security risks will only grow alongside AI’s expanding capabilities.

The choice is clear: either organizations take control of access security now, or AI will expose its weaknesses for them.

About the essayist: Jim Alkove is co-founder and CEO of Oleria. He led security at Salesforce, Microsoft, and Google Nest, advises startups like Aembit and Snyk, and holds 50 U.S. patents. He earned an electrical engineering degree from Purdue University.

The post GUEST ESSAY: How AI co-pilots boost the risk of data leakage — making ‘least privilege’ a must first appeared on The Last Watchdog.

For the past 25 years, I’ve watched the digital world evolve from the early days of the Internet to the behemoth it is today.

Related: Self-healing devices on the horizon

What started as a decentralized, open platform for innovation has slowly but surely been carved up, controlled, and monetized by a handful of tech giants.

Now, a new wave of technological development—edge computing, decentralized identity, and privacy-first networking—is promising to reverse that trend. Companies like Muchich-based semi-conductor manufacturer Infineon Technologies are embedding intelligence directly into sensors and controllers, giving devices the ability to process data locally instead of shipping everything off to centralized cloud servers.

Meanwhile, privacy-focused projects like Session and Veilid are pushing for decentralized communication networks that don’t rely on Big Tech.

On the surface, this all sounds like a step in the right direction. But I can’t help but ask: Does any of this actually change the power dynamics of the digital world? Or will decentralization, like so many tech revolutions before it, just get absorbed into the existing system?

Disrupting business as usual

The move toward decentralized control at the edge is more than just hype. Companies like Infineon are developing zonal computing architectures in modern vehicles, where instead of having a single central control unit, intelligence is distributed throughout the car. This makes the system more responsive, more efficient, and less dependent on a cloud connection.

In smart cities, factories, and even consumer devices, similar trends are taking shape. Edge AI chips, secure microcontrollers, and embedded processors are allowing real-time decision-making without needing to send every bit of data to a distant data center.

Less data movement means fewer security risks, lower latency, and—potentially—less corporate control over user data.

But here’s the catch: technology alone doesn’t change who profits. The entire economic foundation of Big Tech is built on centralization, data extraction, and monetization. And unless that changes, decentralized infrastructure will just be a more sophisticated way for companies to keep controlling users.

We’ve seen this play out before. Apple, for instance, touts privacy as a key feature—offering on-device encryption, Secure Enclave, and privacy-first AI processing. Yet Apple’s actual business model still locks users into its ecosystem and rakes in billions through services, cloud storage, and app store commissions.

The same thing could happen with decentralization—Big Tech could give us just enough edge computing to improve efficiency while still keeping all the real control.

Needed change

For decentralization to actually shift power back to users, we need more than just technical advancements. We need a fundamental shift in the way digital businesses make money.

Right now, most of Big Tech runs on:

•Data extraction (Google, Meta, OpenAI) – AI models are hungry for data, and companies will keep finding ways to feed them, whether through search history, chat inputs, or enterprise contracts.

•Subscription lock-in (Microsoft, Adobe, Amazon AWS) – Even as infrastructure becomes more decentralized, companies still design services that tether users to their ecosystem through proprietary features and recurring fees.

•Cloud dependency (IoT, Smart Devices, Enterprise AI) – Even if devices get smarter at the edge, they’re still linked back to centralized platforms that dictate the rules.

So how do we break that cycle?

Reversing the pendulum

There are a handful of efforts trying to disrupt the status quo. Some of the more promising ones include:

•Decentralized identity (DID) – Projects like DXC Technology’s decentralized identity initiatives allow users to control their own authentication credentials, instead of relying on Google, Apple, or Microsoft to log into everything.

•Privacy-first communication – Apps like Session (a decentralized, onion-routed messaging service) and Secure Scuttlebutt (a peer-to-peer social network) are proving that people don’t need to rely on Big Tech to communicate securely.

•Distributed storage and compute – Technologies like IPFS (InterPlanetary File System) and Urbit are moving away from cloud-based storage in favor of fully decentralized data ownership.

But there’s a problem: most people still opt for convenience over privacy. That’s why Facebook survived the Cambridge Analytica privacy debacle. That’s why people still use Gmail despite deep-rooted privacy concerns. That’s why Amazon’s smart home ecosystem remains dominant, even though it’s clear that users are giving up control to a monetization-obsessed corporation.

Role, limits of regulation

Regulators—particularly in Europe—are trying to push back.

The Digital Markets Act (DMA) and GDPR enforcement actions have forced some minor course corrections, and OpenAI, Google, and Meta have all faced scrutiny for how they handle personal data.

But is it enough? History suggests that Big Tech would rather pay fines than change its core business model. In the U.S., regulators have been even more reluctant to intervene, allowing tech companies to grow unchecked under the guise of “innovation.”

So while regulatory efforts help, they’re not the real solution. The real change will only happen if decentralized business models become financially competitive with centralized ones.

The wildcard may yet prove to be hardware-driven decentralization. One of the biggest reasons Big Tech has been able to maintain its grip is the cloud-based nature of digital services. But edge computing advancements could change that—not because of privacy concerns, but because they make devices cheaper, faster, and more resilient.

Infineon’s work on zonal computing in vehicles, for example, isn’t driven by ideology—it’s a practical, cost-saving innovation that also happens to decentralize control. If similar trends take hold in smart factories, industrial automation, and consumer electronics, companies may start decentralizing for efficiency reasons rather than because of user demand.

That could be the key. If decentralization delivers real cost, speed, and security benefits, businesses might start shifting in that direction—even if reluctantly.

Course change is possible

Where Does This Leave Us? We’re at a turning point. The technology for decentralization is here, but the business models haven’t caught up. If companies continue monetizing user control the way they always have, then decentralization will just be a buzzword—absorbed into the existing system without shifting power in any meaningful way.

For real change, we need:

•Economic incentives that make privacy-preserving, user-controlled services profitable.–Hardware-driven decentralization that forces change from the bottom up.

•Regulatory frameworks that go beyond fines and actually reshape the competitive landscape.

•Consumer awareness that demands real control, not just convenience.

The next few years will decide whether decentralization actually shifts power to users or just becomes another selling point for Big Tech.

The technical advancements in IoT infrastructure—decentralized control, edge computing, and embedded intelligence—are promising steps toward reducing reliance on centralized data processing and improving privacy, efficiency, and system resilience.

But without a corresponding shift in business models, these innovations could still end up reinforcing the same exploitative data practices we’ve seen in cloud computing and social media.

For decentralization to truly matter, companies need to rethink how they monetize technology. The entrenched tech giants will have to be forced to change; it’s going to require pressure from consumers and regulators – and competition from innovators with a different mindset.

Companies like Infineon are providing the technical foundation that could enable a different model—if startups, policymakers, and forward-thinking enterprises push in that direction.

So the key question is: Will the next wave of tech entrepreneurs build on this decentralized foundation, or will Big Tech co-opt it into another walled garden? Right now, it could go either way.

I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

 

 

The post My Take: Will decentralizing connected systems redistribute wealth or reinforce Big Tech’s grip? first appeared on The Last Watchdog.

We’re just getting started down the road to the Internet of Everything (IoE.)

Related: IoT growing at a 24% clip

To get there – to fully tap the potential of a hyper-interconnected ecosystem where devices, data, AI and humans converge to benefit humankind – cybersecurity must first catch up.

I had an edifying conversation about this with Steve Hanna, distinguished engineer at Infineon Technologies, a global semiconductor leader in power systems and IoT, based in Neubiberg, Germany.

We went over how Zero Trust Architecture (ZTA) is gaining steam — and how it embodies a critical paradigm shift necessary to secure hyper-interconnected services.

Not coincidentally, industry standards groups and government regulators have stepped forward to embrace a vital supporting role. Respectively, they’ve begun shaping and implementing new technical protocols and best practices, backed by a fresh slate of audit requirements, to raise the bar of security to where it needs to be.

For a full drill down on how all this ties together – and why it bodes well – please view the accompanying videocast. Here are a few takeaways:

Walls must come down

The front lines of cybersecurity are in flux. Perimeter-focused defenses must be retired and the focus must shift to where the action is — at the furthest edges of the internet, where billions of IoT sensors and controls are proliferating — with scan oversight.

At this moment, as innovation sprints ahead, the mechanisms to secure these edge devices lag dangerously behind. Statista estimates there will be north of 30 billion connected devices by 2030, embedded in systems as varied as pacemakers, wind turbines and smart refrigerators. Each of these devices represents a potential point of failure, susceptible to attack or malfunction.

The challenge lies in the very nature of these devices, Hanna told me. Unlike the robust servers of a data center, IoT sensors are often small, resource-constrained, and low-cost, with limited capacity for complex security measures.

Until recently, their protection depended on surrounding them with layers of external security—firewalls, secured networks and cloud-based monitoring systems. But this castle wall approach is wholly unsuited for protecting hyper-interconnected systems.

The zero-trust imperative

By contrast, ZTA imposes this concept: trust no one, verify everything.

Applying this philosophy to edge devices translates into emphasizing continuous verification rather than the traditional practice of implicitly trusting anyone who gets inside the castle wall.

Hanna

“You can no longer trust the network,” Hanna observes. “Every device, every connection, every interaction must be verified, authenticated, and monitored.”

At the heart of this metamorphosis is a hardware revolution. New generations of microchips can embed encryption, monitoring and control capabilities into devices at the edge – at scale.

This includes everything from a smart home master control to the steer-by-wire mechanisms in a driverless vehicle. In hospitals, these next-gen smart chips are turning up in patient monitoring systems and robotic surgical instruments. And in manufacturing plants, they’re increasingly found in industrial control systems and autonomous robotics.

These chips enable unique device identities, secure communications and even self-healing capabilities. This automated resiliency, if you will, is critical to realizing zero trust in highly complex, IoE environments. “These devices can’t rely on their surroundings for security anymore,” he notes. “They need to secure themselves, from the hardware up.”

Collaborative muscle

While these hardware advancements are promising, they also highlight the scale of the challenge. The expansion of IoT into IoE has vastly expanded the range of potential targets for cyberattacks.

Hackers have exploited everything from fish tank thermometers to baby monitors, turning them into entry points for broader attacks. In one notable case, attackers used internet-connected cameras to assemble the infamous Mirai botnet capable of launching a massive distributed denial-of-service (DDoS) attack.

Governments and standards bodies are taking note. Initiatives like the Matter standard for smart home appliances aim to ensure that IoT devices can communicate securely and reliably across ecosystems. Meanwhile, regulations such as California’s IoT Security Law and the European Union’s Cyber Resilience Act are pushing manufacturers to embed minimum security standards into their designs.

But Hanna warns that regulation alone cannot solve the problem. “The industry has to work together,” he says. “The chipmakers, software developers and device manufacturers all have a role to play. Securing IoT is a collaborative effort.”

Self-healing devices

The road ahead remains daunting. The arrival of post-quantum computing threatens to upend current encryption standards, while the increasing use of artificial intelligence in attacks could automate and amplify threats. Even today, many IoT devices still lack basic protections, and retrofitting them with security is rarely feasible.

Yet there is reason for optimism. The integration of AI-driven anomaly detection into IoT systems, at the chip level, promises a new level of vigilance, enabling devices to flag unusual behaviors—such as a refrigerator attempting to unlock a smart door—and quarantine themselves before harm is done.

By shifting more security functions onto the devices themselves, reliance on legacy, perimeter defenses can take a smaller role. Ultimately, this should give rise to resiliency in each and every sensor and controller at the edges of hyper-interconnected systems.

“We want to get to devices that are capable of healing themselves,” Hanna says.

Securing the Internet of Everything to allow for its full fruition is well on its way. I’ll keep watch and keep reporting

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

The post MY TAKE: Securing the Internet of Everything: why self-healing devices are the next frontier first appeared on The Last Watchdog.

As one of his final official acts, President Joe Biden issued a landmark directive, addressing the evolving challenges posed by cyber threats while charting a strategic course toward a more secure digital ecosystem.

Related: How Trump views of AI, crytocurrency, cybersecurity

As a new White House administration takes charge, one can only hope that the U.S. follows through on this commitment to fortify cyber defenses at home, as well as cooperate with allies abroad to safeguard critical infrastructure, businesses and citizens, globally, from escalating cyber threats.

In recent years, the frequency and sophistication of cyberattacks have surged, targeting industries ranging from healthcare and energy to finance and education. Nation-state actors, ransomware groups, and hacktivists have compromising sensitive data, disrupted essential services and interfered with elections.

Against this backdrop, Biden’s cybersecurity executive order (EO) delivers a much-needed framework for enhancing cybersecurity resilience across public and private sectors.

Biden’s EO builds on earlier initiatives, such as the Cybersecurity and Infrastructure Security Agency’s (CISA) “Shields Up” campaign and the federal government’s Zero Trust Architecture (ZTA) mandates. It goes further by introducing actionable measures to address systemic vulnerabilities and promote collaboration between government entities, private enterprises and international allies.

Biden’s key provisions

At its core, the Biden EO emphasizes a proactive approach to cybersecurity, with several key provisions:

•Critical infrastructure security: Recognizing that critical infrastructure underpins national security and economic stability, the EO mandates stricter security protocols and encourages the adoption of advanced technologies to detect and mitigate threats.

•Supply chain integrity: To counter risks posed by compromised software and hardware, the EO calls for comprehensive supply chain risk assessments and adherence to secure software development practices, including the Software Bill of Materials (SBOM).

•Public-private partnerships: The EO strengthens collaboration between government agencies and private sector stakeholders. By fostering information-sharing initiatives and incentivizing the adoption of best practices, the administration aims to close communication gaps that have historically hindered incident response efforts.

•Workforce development: Addressing the cybersecurity talent shortage, the EO allocates resources to expand training programs, scholarships, and pathways for underrepresented groups to enter the cybersecurity field. Building a diverse and skilled workforce is vital for long-term resilience.

•Global cyber norms: Recognizing that cybersecurity is a transnational issue, the EO reaffirms the U.S. commitment to international cooperation. Establishing global norms and agreements can reduce the risk of conflict and promote collective action against cyber adversaries.

Why this matters now

This EO arrives at a pivotal moment when cyber threats are not only increasing in number but also in complexity. The ongoing digitization of critical infrastructure—from water systems to transportation networks—exposes the nation to unprecedented vulnerabilities. Furthermore, the rise of generative AI has introduced new attack vectors, enabling threat actors to launch sophisticated phishing campaigns and exploit emerging technologies.

However, what sets this EO apart is its holistic perspective. It does not merely respond to threats but seeks to anticipate and mitigate them by integrating cybersecurity into the fabric of governance, commerce, and innovation. By emphasizing collaboration and systemic improvements, the EO lays the groundwork for sustainable progress.

While the challenges are formidable, Biden’s EO inspires optimism for several reasons. First, its emphasis on Zero Trust principles signals a paradigm shift in cybersecurity, moving away from perimeter-based defenses to a model that assumes breaches will occur and limits their impact.

This approach aligns with industry best practices and reflects a growing consensus on effective defense strategies.

Cultivating talent

Second, the EO’s focus on workforce development and diversity has the potential to catalyze a new era of innovation. By investing in the next generation of cybersecurity professionals, the U.S. can cultivate talent capable of addressing both current and future challenges.

This initiative also positions the country as a leader in cybersecurity education and training, setting an example for other nations to follow.

Third, the commitment to public-private partnerships represents a significant step forward in bridging the gap between policy and practice. Cybersecurity is a shared responsibility, and the EO’s collaborative framework encourages stakeholders to work together toward common goals. This unity is essential for creating a resilient digital ecosystem.

Global norms needed

Finally, the EO’s emphasis on global cyber norms reflects an understanding that cybersecurity is a global issue requiring coordinated action. By leading international efforts to establish norms and agreements, the U.S. can foster a more secure and stable digital environment for all nations.

President Biden’s cybersecurity EO is a bold and comprehensive response to the pressing challenges of our time. By addressing vulnerabilities, promoting collaboration, and investing in the future, it paves the way for a more secure and resilient digital landscape.

Implementation will require sustained effort and cooperation – meaning President Trumo must embrace this blueprint for progress. In the face of relentless cyber threats, this initiative stands as a beacon of hope and a testament to what can be achieved through collective action.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

 

The post MY TAKE: Here’s why Donald Trump really needs to fully embrace Joe Biden’s cybersecurity EO first appeared on The Last Watchdog.

President Biden’s detailed executive order relating to cybersecurity is great to see.

Biden’s order reflects the importance of cybersecurity at the highest levels – it is an issue of national security and should be treated as such.

One of the big themes coming out of the order is the need to implement the right controls, and being able to provide evidence. Section two really underscores the need for secure software development.

If it is followed through, software publishers will need to open their kimonos to show they have the right controls in place and that these are working effectively.

It is also interesting to see in section seven that NIST will be issuing guidance on “minimum cybersecurity practices”, considering common cybersecurity practices and security controls.

Gill

Moving forward, we can expect to see even greater emphasis not just on encouraging companies to implement controls, but on providing evidence of such. However, many companies will struggle here.

IT infrastructures and ecosystems have become incredibly complex. Most large organizations do not even have visibility of what assets they have, let alone the status of their security controls across those assets.

This isn’t due to a lack of effort or care from cybersecurity professionals. The challenge lies in the fact that most large organizations rely on 50+ cybersecurity tools to protect their fast-moving IT environments.

These tools operate in silos, disconnected from one another and informed by incomplete configuration management databases (CMDB). As we move into an era of ‘trust, but verify’, organizations will be under increasing pressure not only to outline what controls they have, but to demonstrate their effectiveness.

Most large organizations already possess the data they need to understand their assets, controls coverage, and controls effectiveness, but it’s scattered and inaccessible. This data must be transformed into actionable, trusted intel, enabling security leaders to identify gaps, enforce accountability, and ensure stakeholders meet agreed-upon standards of controls.”

About the essayist: Jonathan Gill is CEO at Panaseer which supplies a continuous controls monitoring solution

The post GUEST ESSAY: President Biden’s cybersecurity executive order is an issue of national security first appeared on The Last Watchdog.

To wrap up our 2024 year-end roundtable, we turn our attention to new technologies and trends that are emerging to help bridge the gaps.

Part four of our  four-part series

From cybersecurity skills shortages to the pressures of hybrid work, the challenges facing organizations are at an all-time high. Experts here explore the importance of fostering a resilient workforce, backed by AI-enhanced training and layered security strategies.

The encouraging news is that new technologies, like Zero Trust architecture and AI-enhanced security tools are gaining traction – for instance, AI is expected to take a much larger role, going forward, in helping organizations address the persistent talent shortage, which in turn, will make automated defenses, focused at the Internet edge, even more effective.

As companies continue to grapple with rising threats and the shifting needs of a digital world, building a strong, adaptable team may be the ultimate key to survival.

Shashanka

Dr. Madhu Shashanka, Chief Data Scientist, Concentric AI

Generative AI in 2025 will bring transformative opportunities but heightened cybersecurity risks, including data exposure, AI misuse, and novel threats like prompt injection attacks. Enterprises must secure AI agents, adopt proactive data governance, and deploy AI-based security platforms. Collaborative efforts between security vendors, AI providers, and businesses will be key to counter automated, scalable attacks. Real-time defense and a robust security mindset are crucial to staying resilient.

Karl Holmqvist, CEO, Lastwall

In 2025, the “Steal-Now, Decrypt-Later” threat will accelerate post-quantum cryptography (PQC) adoption. Quantum computing advances are making traditional encryption obsolete, and adversaries are stockpiling data for future decryption. FIPS-203 enables legal PQC deployment, prompting CISOs to overhaul encryption strategies. Without action, quantum-enabled breaches threaten critical data, national security, and global stability.

Amini

Pedram Amini, Chief Scientist, Opswat

The sophistication and abuse of AI are escalating as costs drop, driving a surge in ML-assisted scams and attacks on physical devices. Organizations face rising risks of AI-driven social engineering and personal device breaches. As compute costs decrease, autonomous operations and AI-discovered zero-day exploits loom. While fully agentic AI malware remains years away, the industry must prepare now.

Shoshani

Or Shoshani, CEO,   Stream Security

In 2024, 65% of breaches involved cloud data, highlighting a critical gap in cloud security. Despite widespread cloud adoption, most SecOps teams rely on outdated, on-premises alert tools, leading to missed threats and wasted resources on false positives. To reduce cloud-based attacks, organizations must integrate real-time cloud insights into SOCs, ensuring consistent threat detection, faster responses, and lower risks of material breaches in 2025 and beyond.

Xu

Jimmy Xu, Field CTO, Cycode

In 2025, application security will evolve from vulnerability identification to intelligent prioritization and automated remediation, enabling developers to address critical risks within their workflows. With tighter budgets, organizations will adopt integrated platforms for efficiency and cost-effectiveness. Traditional AST tools disconnected from the SDLC will fade, while AI capabilities will become essential, augmenting security teams and protecting AI-powered applications.

Simic

Bojan Simic, CEO, HYPR

The era of passwords will further decline as credential misuse rises, with AI both aiding and challenging security efforts. Our research reveals 69% of breaches are rooted in inadequate authentication and 78% of organizations have been targeted by identity-based attacks. The growing sophistication of cyber threats demands robust identity assurance solutions that include multifactor authentication, risk monitoring and adaptive verification – collectively forming multi-factor verification (MFV.)

Lanowitz

Theresa Lanowitz, Chief Evangelist,   LevelBlue

In 2025, cybersecurity success hinges on integrating it into core business operations. DevSecOps shifts security from a reactive process to a proactive framework, embedding it early in development. Collaboration between cybersecurity, development, and business teams requires data-driven insights and shared priorities. By addressing attack vectors upfront and aligning security with business goals, organizations can build resilience and make cybersecurity a fundamental business requirement.

Tavakoli

Oliver Tavakoli, CTO, Vectra AI

In 2025, the initial excitement surrounding security copilots will begin to diminish; we’ll see a shift in the narrative toward more autonomous AI systems designed to operate independently, requiring minimal human intervention. Marketing efforts will increasingly highlight these autonomous AI models as the next frontier, touting their ability to detect, respond to, and even mitigate threats in real-time – all without human input.

Freestone

Tim Freestone, Chief Strategy Officer, Kiteworks

Organizations can address the privacy and compliance talent gap by using AI to automate tasks like audit trails, data access logs, and compliance monitoring. This frees teams for strategic efforts like risk management. Promoting continuous learning in privacy tech, AI governance, and Zero Trust, alongside partnerships with educational institutions, helps build a skilled workforce to meet evolving regulatory demands.

Dooley

Doug Dooley, COO, Data Theorem

In 2025, cybersecurity threats will escalate across APIs, cloud setups, supply chains, and cryptocurrency. API exploits will target shadow APIs and broken object-level authorization (BOLA) flaws, while cloud misconfigurations in hybrid setups expose sensitive data. Supply chain attacks will intensify through poisoned APIs and unchecked software dependencies. AI-powered cryptocurrency attacks will automate phishing and exploit vulnerabilities. Organizations must automate cloud monitoring, fortify supply chains, and leverage AI defenses.

Dulce

Sagie Dulce, VP Research, Zero Networks

In 2025, AI will empower both defenders and attackers—improving incident response for the former while accelerating exploits and phishing for the latter. Securing AI poses challenges due to unpredictable backends and access to sensitive data. To mitigate risks, organizations must enforce Zero-Trust principles, limit AI access to privileged accounts, and sanitize AI prompts. As tech complexity rises, Zero-Trust remains critical for robust cybersecurity.

Tang

Tim Tang, Director, Enterprise Solutions, Hughes Network Systems

As cyber threats escalate, AI-enabled technologies are enabling enterprises to mount an effective defense. Enterprises are using AI-enabled automations to satisfy the Tier 1 cyber activities. Network Detection and Response (NDR) solutions use AI to extrapolate and identify latent threats. Anti-ransomware solutions incorporate AI to aggregate system-level insights and protect against zero-day attacks. AI is also easing cyber talent gap — by increasing productivity, job satisfaction and thus retention.

Thaman

Alex Thaman, CTO, Andesite

Criminals and nation states will become much faster and more sophisticated at gaining unauthorized access — and acting on that access. I would expect to see a stepwise increase in sophistication in 2025 leaving many organizations unprepared until improved defense technology and better training is adopted. We can expect security teams feeling pressure to adopt new technology quickly.

Tipirneni

Ratan Tipirneni, CEO, Tigera

To maximize GenAI’s value, enterprises will customize models using proprietary data and Retrieval-Augmented Generation (RAG) architectures tailored to their specific needs. With flexibility in deploying GenAI across cloud and on-premises environments, Kubernetes is emerging as the dominant platform. This shift heightens the focus on securing Kubernetes with microsegmentation, continuous monitoring, vulnerability management, and runtime protections to safeguard sensitive data as GenAI adoption surges in 2025.

Kowski

Stephen Kowski, Field CTO, SlashNext Email Security+

Organizations can address the cybersecurity talent gap by using AI-powered automation for routine tasks like threat detection and incident response. This enables security teams to focus on strategic priorities and complex investigations. AI acts as a force multiplier, reducing alert fatigue and burnout while processing vast security telemetry. Key applications include automated phishing detection, real-time behavior analysis, and intelligent event correlation across channels, enhancing efficiency and impact.

Vargas Valles

Mario Vargas Valles, VP Global Technology Alliances,   Protegrity

AI’s ability to read and interpret compliance requirements through Natural Language Processing (NLP) will help ensure regulatory alignment, adding layers of security across regions and industries. And as regulations tighten globally, AI itself will need to meet high transparency standards, actively supporting data governance with automated discovery, classification, and quality control processes.

Nanjundappa

Prashanth Nanjundappa, VP, Product Management,   Progress

Quality Assurance Operations (QAOps)  helps ensure quality assurance is part of the software development lifecycle. QAOps will help DevSecOps adoption by fostering better collaboration between QA, development, operations and security teams. This integrated approach reinforces that security is a shared responsibility and helps confirm all teams are aligned on security goals.

Zimerman

Amit Zimerman, Chief Product officer, Oasis Security

The shortage of AI security skills is a growing concern. Organizations must invest in AI security training, focusing on foundational knowledge and emerging threats like prompt injection. Partnering with universities and certification bodies can standardize curricula, while fostering collaboration between AI, security, and engineering teams enhances threat response. Integrating AI-enabled security tools requires real-world testing, updating legacy frameworks, and adopting flexible policies to stay ahead of evolving threats.

Parnes

Ariel Parnes, COO, Mitiga

In 2025, the convergence of generative AI and SaaS adoption will redefine cybersecurity. AI will enable attackers to craft adaptive phishing campaigns, exploit SaaS vulnerabilities, and evade detection, lowering the skill barrier for cybercriminals. Simultaneously, SaaS sprawl will create visibility gaps, leaving organizations vulnerable. To counter this, businesses must adopt AI-driven security tools for real-time monitoring, threat detection, and anomaly identification across cloud applications.

Kannry

Scott Kannry, CEO, Axio

Cybersecurity is now a business-wide concern, requiring user-friendly, business-focused risk quantification (CRQ) tools to guide decisions on technology adoption and legacy systems. CRQ fosters collaboration via shared risk language and ensures tech stacks align with risk tolerance. As regulations evolve, CISOs are taking on compliance and disclosure roles, prompting some companies to split security leadership into technical and business-focused positions to address these expanded demands.

Jones

Chris Jones, CTO & Chief Data Officer, Nightwing

In 2025, Chief Data Officers (CDOs) must evolve beyond compliance and risk management to unlock data’s strategic potential. As global data complexity grows, CDOs will drive value by enabling advanced analytics, uncovering insights, streamlining operations, and identifying new opportunities. Balancing data management with business innovation, CDOs will bridge the gap between defense and growth, ensuring organizations capitalize on accessible data to achieve strategic goals.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

 

The post LW ROUNDTABLE:  Predictive analytics, full-stack visualization to solidify cyber defenses in 2025 first appeared on The Last Watchdog.

Today, part three of Last Watchdog’s year-end roundtable zeroes in on the regulatory and compliance landscape.

Part three of a four-part series

In 2024, global pressure on companies to implement advanced data protection measures intensified, with new standards in encryption and software transparency raising the bar.

From the push for quantum-resilient cryptography to Software Bill of Material (SBOM ) requirements aimed at bolstering supply chain security, this installment examines the regulatory changes and evolving technical standards poised to reshape compliance expectations.

Our experts discuss the impact of these standards and how organizations can position themselves to adapt to the shifting requirements of a complex, compliance-driven worl

Powell

Dr. Leila Powell, Head of Data, Panaseer

In 2025, more organizations will face increased pressure to measure and demonstrate their security posture, especially as regulatory requirements expand. With new regulations like NIS2, companies will need to prove they have the necessarysecurity controls in place to avoid penalties. This shift is expected to place significant pressure on organizations that haven’t yet developed trusted data to manage risk effectively.

Sherrets

Dane Sherrets, Innovation Architect, HackerOne

We’ll see greater industry adoption of AI security and safety standards. One  example of is AI model cards, which inform users about how AI models are intended to be used . . . I’m also confident we will see more organizations become more concerned with responsible AI adoption and use adversarial testing methods, like AI red teaming, to identify safety and security challenges in GenAI.

Srivatsav

Ravi Srivatsav, CEO, DataKrypto

Non-compliance with regulations, such as the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), risks severe penalties. And industries like healthcare face persistent targeting due to their outdated systems and high-value data. To mitigate risks, businesses will invest in modern, privacy-enhancing technologies (PETs), such as trusted execution environments (TEEs) and fully homomorphic encryption (FHE).

Wojtasiak

Mark Wojtasiak, VP of Research and Strategy, Vectra AI

In the coming year, we’ll see the initial excitement that surrounded AI’s potential in cybersecurity start to give way due to a growing sense of disillusionment among security leaders. Vendors will need to demonstrate tangible outcomes, such as reduced time to detect threats, improved signal accuracy, or measurable reductions around time spent chasing alerts and managing tools.

Balonis

Frank Balonis, CISO, Kiteworks

By 2025, 75% of the global population will be protected under privacy laws, including U.S. state privacy laws, the EU’s governance of ethical AI deployment, and updated regulations in India and Japan. Similarly, software bills of materials (SBOMs) underscore the need for better accountability in third-party software. Fostering cross-department collaboration between compliance, IT and legal teams can help organizations stay ahead — and maintain stakeholders’ trust.

Taylor

Howard Taylor, CISO, Radware

The EU’s AI First regulation aims to protect individuals from AI-based profiling and decision-making. However, compliance officers must also address emerging risks from Generative AI, like unintentional copyright violations from copied protected content. With regulators unlikely to act soon, the risk management community must proactively define issues and establish rules to address these challenges.

Gupta

Vishal Gupta, CEO, Seclore

In 2025, cyber regulations will shift focus from privacy to geopolitics. Following decades of security control mandates and privacy rights protections, new laws will prioritize national interests amid rising geopolitical tensions. Policies like the CHIPS Act and stricter ITAR/EAR rules reflect a “country over collaboration” mindset, with regulations aiming to shield supply chains and counter perceived adversaries, reshaping the global cybersecurity landscape.

Ehrmann

Marielle Ehrmann, Chief Security Compliance & Risk Officer, SAP

The convergence of AI and cloud computing is reshaping the regulatory landscape. Key measures like the EU Cybersecurity Act, US software transparency rules, and AI-focused laws (e.g., EU AI Act) demand proactive adaptation. The SEC Cybersecurity Disclosure Rule highlights transparency in governance. To stay compliant, organizations should centralize compliance management, automate monitoring, conduct regular audits, and enforce AI governance to align with evolving global standards.

Barisoff

Wade Barisoff, Director of Product – Data Protection, Fortra

In 2025, new global regulations like the EU AI Act, GDPR updates, Malaysia’s privacy laws, and U.S. state privacy laws are reshaping compliance. Smaller businesses must now adhere to strict standards, focusing on tools and processes to protect data and partners. Failure risks fines or supplier bans. These rules, targeting first-party suppliers, will likely expand as attackers exploit vulnerabilities, driving evolving compliance requirements.

Seara

Jose Seara, CEO, DeNexus

Recent regulatory updates highlight a shift toward robust cyber risk governance, requiring organizations to adapt. The NIST Cybersecurity Framework 2.0 emphasizes governance, while the SEC mandates cyber risk reporting and incident disclosures. CISA updated its “Secure by Design” guidance, and the EU’s Cyber Resilience Act and NIS2 added new requirements. Proactive collaboration and cyber risk quantification are key to ensuring operational resilience and security.

Simberkoff

Dana Simberkoff, Chief Risk, Privacy and Information Security Officer, AvePoint

Thoughtful regulation can drive innovation by creating guardrails that foster trust and safety while maintaining flexibility. The EU’s AI Act exemplifies this balance, potentially inspiring global standards. New EU cybersecurity regulations, akin to GDPR’s transformative impact, will reshape defense-in-depth strategies. Heightened focus on third-party risk, spurred by incidents like CrowdStrike, underscores the urgency of supply chain transparency, SBOMs, and proactive vendor risk management to avoid costly vulnerabilities.

Hoff

Alex Hoff, Chief Strategy Officer, Auvik Networks

As technology evolves, regulations struggle to keep pace, especially around AI and data privacy. National and international organizations must navigate compliance complexities from differing state, federal, and global requirements. Adhering to frameworks like NIST or CIS can help, but compliance alone doesn’t guarantee security. Overemphasizing compliance risks diverting resources from advanced security challenges. Success lies in balancing regulatory demands with proactive security innovation.

hdsht

Dale Hoak, Director of Information Security, RegScale

By 2025, AI-driven compliance tools will dominate as regulatory demands grow, replacing manual GRC processes. Organizations will automate real-time checks, audits, and risk monitoring, fueled by stricter frameworks like GDPR and FedRAMP. Privacy law convergence will ease global commerce by standardizing rules, urging businesses to adopt agile GRC systems. Supply chain cybersecurity certifications will rise, driving demand for platforms offering vendor risk assessment, monitoring, and reporting.

Bruno Kurtic, CEO, Bedrock Security

By 2025, rising AI regulations and security risks will push organizations to prioritize data visibility, classification, and governance. Creating a data bill of materials (DBOM) for AI datasets will become standard, detailing data origin, lineage, and sensitivity to ensure responsible AI training. Scalable solutions and strict entitlements will enhance access control, advancing data governance and reducing exposure risks as data volumes grow.

Krull

Jeff Krull, cybersecurity practice leader, Baker Tilly

In 2025, stronger regulations like GDPR and CCPA, along with advancements in security technology, will enhance consumer device protection. Tech companies are adopting “cybersecurity by design,” embedding encryption, biometrics, and multi-factor authentication into products. Government initiatives and awareness campaigns will educate users on phishing and malware threats. Despite progress, the human element remains a challenge, underscoring the need for ongoing digital literacy to complement these evolving protections.

Owen

Dylan Owen, CISO, Nightwing

In 2025, cyber regulations will impact key sectors like Defense, Healthcare, Finance, and Energy. The Cybersecurity Maturity Model Certification (CMMC) rollout will require Defense contractors to upgrade systems, incurring costs. AI/ML regulations will address ethical concerns like bias and transparency, while federal and state efforts push for unified privacy laws. Critical Infrastructure reporting rules from CISA and TSA could also reshape compliance, highlighting cybersecurity’s bipartisan importance.

Kannan

Rahul Kannan, President, COO & Head of GTM, Securin 

The recent CrowdStrike outage underscored the impact of flaws in development, demonstrating that secure coding practices are crucial to preventing disruptions. As breaches continue to escalate in frequency and cost, the demand for cyber insurance and heightened regulatory compliance will rise, pushing companies to not only protect their data but to prove adherence to evolving security standards.

Nick Mistry, SVP, CISO, Lineaje

Most companies work with 11 third parties — 98% of whidh have experienced a breach. Amazon’s third-party property management vendor came out as the latest victim in the MOVEit Transfer incident . . . . businesses need to proactively detect and address risks in the software supply chain and use solutions that provide frequent security audits, assessments, and ongoing third-party software monitoring.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

 

The post LW ROUNDTABLE: Compliance pressures intensify as new cybersecurity standards take hold first appeared on The Last Watchdog.

Continuing our look back at 2024, part two of Last Watchdog’s year-ender roundtable turns its focus to emerging threats vs. evolving defense tactics.

Part two of a four-part series

The explosion of AI-driven phishing, insider threats, and business logic abuse has forced a shift toward more proactive, AI-enhanced defenses. The drivers are intensifying. Gen AI threats and quantum computing exposures must be accounted for. Meanwhile, while business logic hacks, supply chain holes, and cyber extortion continue to loom large.

Defenders must evolve – more rapidly that ever — to meet these growing challenges. Today’s insights offer a close look at how the most agile organizations are tackling these threats head-on.

Williams

Brandon Williams, CTO, Conversant Group

Predictions for 2025 point to attack speeds increasing by up to 100X, necessitating faster detection and response times. Businesses must adopt tools and automation capable of invoking immediate action, even at the risk of false positives. IT teams need greater trust to act decisively, such as disconnecting systems during threats. Raising security baselines across industries is essential, with risk mitigation—not acceptance—becoming the standard.

Salzman

Shirley Slazman, CEO, SeeMetrics

In 2025, organizations will recognize that adding more tools doesn’t equate to better security. Similarly, relying on compliance checkboxes for static reassurance will no longer suffice. True visibility requires the ability to blend data from multiple tools. By correlating this data with programs, certifications and threats, businesses can manage their defenses with full context. This empowers them to proactively prioritize what matters most.

Williams

Dr. Darren Williams, CEO, BlackFog

Lesser-known ransomware groups like Hunters International will grow rapidly, leveraging AI for more efficient attacks, while “gang-hopping” by cybercriminals complicates attribution and containment. Deepfake scams will escalate, with threat actors using AI to create convincing impersonations of executives, risking personal and corporate brands. Meanwhile, ransomware attacks on healthcare providers will persist, targeting outdated systems and jeopardizing patient care, emphasizing the need for stronger defenses to protect critical services.

Alkove

Jim Alkove, CEO, Oleria

Identity is cybersecurity’s biggest challenge. Attacks targeting identities rose 71% last year, with valid accounts as the top entry point. Attackers aren’t hacking in — they’re logging in. Legacy IAM systems can’t keep up as AI-powered phishing and deepfakes grow more sophisticated. Organizations must adopt adaptive, automated identity security and fine-grained access controls, like the solutions Oleria is developing, to stay protected.

Sundaresan

Bindu Sundaresan, Cybersecurity Director, LevelBlue

In 2025, cybercriminals will exploit supply chain vulnerabilities, ransomware, IoT botnets, and AI-driven phishing. Ransomware targeting critical services highlights the need for secure software lifecycles and vendor verification. Rising IoT use demands standards to prevent device weaponization, while AI-enabled phishing challenges defenses. Organizations must fortify supply chains, adopt IoT standards, and leverage AI to stay ahead in this evolving threat landscape.

Geenens

Pascal Geenens, Director of Threat Intelligence, Radware

In 2025, AI-driven exploitation will challenge cybersecurity teams with shrinking windows between vulnerability disclosure and attack. Automated one-day exploits will demand real-time responses, rendering traditional patching cycles inadequate. Success will require adaptive, AI-driven defenses and a proactive, strategic mindset. Agility and innovation will define the defenders who can stay ahead in this escalating battle.

Halder

Ayan Halder, Principal Product Manager, Traceable AI

The Bot Protection industry has traditionally focused on browser automation attacks using client-side signals. However, the rise of APIs and Crime-as-a-Service tools enables attackers to bypass traditional methods and target APIs directly. By 2025, traditional bot detection and advanced API analytics will converge, expanding API security to include robust bot detection and safeguards against business logic abuse, reshaping API runtime protection strategies.

Kornfeld

Bruce Kornfeld, Chief Product Officer, StorMagic

As edge infrastructure expands, the associated attack surface will also grow, necessitating heightened security measures. By 2025, CIOs must adopt comprehensive security frameworks that address vulnerabilities at the edge without compromising overall IT integrity.

Kazerounian

Sohrob Kazerounian, Distinguished AI Researcher, Vectra AI

In 2025, a flood of vulnerabilities will result from apps built on large language models (LLMs.) LLMs grant access to private data and take actions on behalf of users. Compromised LLM-based applications could expose large amounts of personal information, disrupt essential services, or lead to manipulations of decision-making processes. Security teams will need to address the unique risks posed using LLMs in mission critical environments.

Hurd

Wayne Hurd, VP of Sales, Luminys 
Video Surveillance as a Service (VSaaS) advancements will provide more accurate threat detection that allows security teams to focus on real risks, minimizing false alarms. VSaaS can support regulatory compliance across the supply chain, helping to build trust among stakeholders.  VSaaS reduces hardware requirements and energy consumption, supporting organizations’ environmental goals while meeting customer expectations.

Jones

Neil Jones, Director of Cybersecurity Evangelism, Egnyte

If there’s any cybersecurity topic you need to familiarize yourself with in 2025, it’s wiper technology, which could potentially be leveraged by malicious insiders and even business competitors who want to gain an illicit market advantage. Effective Business Continuity & Data Recovery (BCDR) procedures can help. This includes taking snapshot snapshots of your data environment on a regular basis. And immediate  detection of suspicious log-ins can discourage such attacks.

MacMillan

William MacMillan, Chief Product Officer, Andesite

In 2025, we’ll see AI platforms analyze massive amounts of threat intel in seconds. That’s the easy part. The hard part? We’ll see CISOs increasingly demand answers about why models flag certain malicious activity and how that activity is impactful at enterprise scale. To this end, we’ll see greater investment in AI that is transparent and explainable, because machine-speed decisions will need human-level trust and outputs.

Jones

Craig Jones, Vice President of Security Operation, Ontinue

The debate around AI-driven attacks often obscures the reality that many rely on established tactics executed with greater speed and efficiency. Attackers use machine learning for tasks like phishing, but polished tiattacks—manual or automated—are often indistinguishable. Organisations should focus on evolving tactics, not the tools, by investing in behavioural detection, identity controls, and monitoring to counter threats effectively, regardless of AI’s involvement.

Chearis

Karsten Chearis, US Security Sales Engineer – Team Lead, XM Cyber

Resiliency involves four stages, while compromise has three phases: about to be compromised, compromised, and recovering. Assuming breaches are inevitable, security leaders must map critical business assets and ensure their resilience. To avoid tool fatigue, organizations need integrated platform solutions. Leveraging frameworks like CTEM can enhance EDR, SIEM, and attack path mapping, driving faster solutions, reducing costs, and demonstrating ROI—empowering CISOs to defend and communicate effectively.

Carignan

Nicole Carignan, Vice President of Strategic Cyber AI, Darktrace

If 2023 was the year of generative AI and 2024 the year of AI agents, 2025 will spotlight multi-agent systems, or “agent swarms.” These systems promise innovation but also introduce risks. Vulnerabilities like data poisoning and prompt injection could have far-reaching impacts due to interconnected agents. As multi-agent systems handle sensitive tasks, robust security and data guardrails are essential to prevent exploitation and ensure trust.

Dunham

Ken Dunham, Cyber Threat Director, Qualys Threat Research Unit

Nation-state attacks and cloud compromises with long dwell times are rising as security lags behind post-Covid digital transformation. Complex DevSecOps, APIs, and cloud integrations will become leading attack vectors, while insider threats and accidental disclosures drive data leakage risks. With adversaries destroying backups to increase extortion payouts, recovery will grow harder and slower, emphasizing the need for stronger security controls and architecture.

Andrew Harding, Vice President, Security Strategy, Menlo Security

AI-driven attacks and browser vulnerabilities, such as recent exploits in Chrome, Edge, and Safari, underscore the need for robust security measures. State-sponsored groups are deploying evasive tactics that bypass traditional defenses. Prioritizing AI-driven browser security mitigates advanced threats, reduces insider risks, and strengthens user protection. A layered approach with zero-trust access, AI defenses, and visibility into user activity can safeguard sensitive data and counter evolving cybercriminal tactics.

Fisher

James Fisher, Director of Security Operations, Secure Cyber

Accelerated automation is crucial as AI-driven attacks shorten timelines, requiring security tools to automate responses and enhance resilience. Global political volatility has heightened the focus on supply chain resilience, prompting organizations to scrutinize providers and refresh disaster plans with seamless backup strategies. Meanwhile, identity-based attacks are rising, pushing teams to address weak credentials and adopt solutions like Single Sign-On with hardware tokens for stronger, user-friendly security.

Knapp

Eric Knapp, CTO of OT, Opswat

The shift to cloud for ICS/OT systems is accelerating, with 26% of organizations adopting cloud solutions, up 15%. While cloud offers flexibility, it introduces new cyber risks. Robust perimeter controls, data diodes for secure data flow, and OT-specific remote access pathways are essential. In 2025, the focus will likely shift toward balanced, layered security investments to improve visibility and resilience against evolving threats.

Gerchow

George Gerchow, faculty, IANS Research; Interim CISO, MongoDB

Nation-state actors are using AI-generated identities to infiltrate companies, bypassing traditional hiring checks with stolen credentials and fake profiles. The FBI reports over 300 companies unknowingly hired imposters who siphoned sensitive data. Meanwhile, AI empowers novice hackers to execute sophisticated attacks, demanding AI-enhanced defenses. Additionally, rising supply chain attacks will push cloud providers to mandate MFA, urging tighter collaboration to address escalating security threats.

DeSimone

John DeSimone, CEO at Nightwing

In 2025, AI will enhance both cybersecurity defenses and adversaries’ attacks, enabling advanced malware, deepfakes, and misinformation. While streamlining threat response, AI’s rapid integration raises ethical concerns, especially in national security. Transparent, traceable, and accountable AI practices are crucial to mitigate biases and align actions with ethical standards. As international guidelines emerge, organizations must prioritize ethical AI use to balance innovation with responsibility.

Barde

Sumedh Barde, Chief Product Officer, Simbian

Organizations face a growing cyber threat landscape alongside a global security talent shortage of 3.4 million (NIST, WEF). This has fueled rapid adoption of autonomous AI agents, which matured significantly in 2024 and will become mainstream in 2025. These agents, while not replacing skilled staff, will scale key functions like SOC and AppSec. Despite challenges, their business value ensures continued progress.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

 

 

The post LW ROUNDTABLE — How 2024’s cyber threats will transform the security landscape in 2025 first appeared on The Last Watchdog.

It’s all too clear that the cybersecurity community, once more, is facing elevated challenges as well as opportunities.

Part one of a four-part series

The world’s reliance on interconnected digital infrastructure continues to deepen, even as the threats facing it grow in sophistication and scope.

The way forward is complex and dynamic — and fraught with potential pitfalls. As 2024 draws to a close, we’re excited to bring you a four-part series, featuring reflections and predictions from leading cybersecurity experts. Each column over the next few days will focus on a distinct theme that encapsulates the core challenges and notable advances in cybersecurity.

In this first of four installments, participating experts reflect on the headline-grabbing incidents of 2024 – and pontificate on the implications for resilience moving into the new year.

Zdjelar

Saša Zdjelar, Chief Trust Officer, ReversingLabs

Software supply chain attacks represent a critical threat, but until 2024, the focus was on open-source vulnerabilities. Following breaches at Sisense, JetBrains, Microsoft Exchange, Okta, and CrowdStrike, the focus has shifted to commercial software. Commercial off-the-shelf (COTS) and cloud-based solutions underpin modern enterprises. With threats targeting these systems escalating, enterprises must implement rigorous independent testing and verification — pre-deployment and for any software updates.

Silva

Joe Silva, CEO, Spektion

Reflecting on attacks in 2024, many organizations lacked visibility into their third-party software leaving themselves open to exploitation. Until organizations can shift software risk management left—beyond reactive patching—they will remain.  Software sprawl continues to expand the attack surface. Without governance and rationalization of their software inventory, organizations will struggle to manage risk effectively, perpetuating a cycle of reactive defenses against an ever-growing threat landscape.

Thornton-Trump

 Ian Thornton-Trump, CISO, Inversion6

In 2024, the convergence of nation-state APTs and cybercriminals raised global alarms. Revelations linked Chinese intelligence to contractors, Russian GRU officers to data destruction, and Iranian APTs to cybercrime collaboration. Despite Russia’s selective crackdowns on ransomware groups, this trend poses escalating risks. If the U.S. treats ransomware as state-sponsored terrorism, countermeasures could become far more aggressive, reshaping the fight against cyber threats.

Endres

Justin Endres, CRO, Seclore

The Microsoft-CrowdStrike outage underscores the dangers of uniform digital infrastructure. A lack of diversity amplifies systemic flaws, creating single points of failure. Organizations relying on single-source OS, EDR, or cloud providers risk widespread disruption. Just as with supply chains, homogeneity in ecosystems breeds fragility. Building diverse systems is crucial to reducing risks and preventing potentially catastrophic consequences from future vulnerabilities.

Paxton-Fear

Katie Paxton Fear,  Security Researcher, Traceable AI

In 2024, API-powered infrastructure faced increasing attacks, often targeting APIs unknowingly exposed by organizations. These subtle, targeted attacks exploit APIs enabled by default. Defenders must prioritize full API visibility, regularly check for new deployments, and critically evaluate API security tools, including AI integrations. A conservative approach focusing on proven solutions over untested technologies is key to mitigating these evolving threats

Ventura

Jeremy Ventura, Field CISO, Myriad360

Cybersecurity incidents in 2024 highlighted the rising threat of third-party supply chain attacks, emphasizing the need for vendor visibility and risk assessments. Organizations must monitor vendor activity, enforce strong security contracts, and conduct table-top exercises to test incident response plans. As digital ecosystems grow more complex, proactive supply chain risk management is critical to mitigating breaches and protecting sensitive data.

Cunningham

 John Paul Cunningham, CISO, Silverfort

Identity-based attacks in 2024, like those on Microsoft and Snowflake, are prompting insurers to intensify scrutiny in 2025. Questions will shift from basic MFA implementation to deeper assessments of least privilege, lateral movement prevention, and real-time identity protection. Rising cyber insurance costs will drive organizations to adopt stronger security measures, linking better practices to lower premiums and fostering a proactive approach to identity and risk management.

Mills

Caleb Mills, Chief Customer Officer, Mission Cloud

When a widely used security tool faced unexpected issues and impacted numerous organizations, those that stayed ahead did so by leaning on real-time detection tools and agile response strategies. Clear communication is paramount; collaboration with security providers is essential. Cybersecurity incidents can quickly ripple through the entire business. Building a strong culture of security and preparedness helps organizations respond quickly and effectively, keeping operations steady when disruptions happen.

Wade

Tim Wade, Deputy CTO, Vectra AI

Attackers continue to leverage AI to streamline attacks, lowering their own operational costs and increasing their net efficacy. The attackers skillfully leveraging  AI are better able predict defensive measures and exploit weaknesses. Defensive teams must understand how to integrate AI into the full range of people, process and technology to stop attackers sooner, with more precision and with broad coverage.

Simic

Bojan Simic, CEO, HYPR

The era of passwords will further decline as credential misuse rises, with AI both aiding and challenging security efforts. Our research reveals 69% of breaches are rooted in inadequate authentication and 78% of organizations have been targeted by identity-based attacks. The growing sophistication of cyber threats demands robust identity assurance solutions that include multifactor authentication, risk monitoring and adaptive verification – collectively forming multi-factor verification (MFV.)

Spencer

Patrick Spencer, VP of Marketing and Research, Kiteworks

Reflecting on 2024, supply chain breaches, like the MOVEit attack and the National Public Data breach, and the massive scale of data exposures, as seen in cases like AT&T’s breach affecting over 180 million customer records, highlights the need for integrated systems to consolidate communication, streamline oversight and reduce vulnerabilities. These events point to an  increased reliance on AI-driven threat detection and automated compliance tools.

Lemon

Josh Lemon, Director, Managed Detection and Response, Uptycs

Attackers now exploit software vulnerabilities in rapid deployments to gain early access and persistence, while evading EDR tools and shifting to overlooked targets like firewalls and VPNs. MFA attacks, leveraging phishing and session hijacking, are set to rise. Nation-states will escalate supply chain disruptions, prioritizing political objectives. Organizations must adapt with proactive, multi-layered defenses to navigate an era of increasingly complex and politically charged cyber threats.

Shah

Rakesh Shah, VP of Product Management,  LevelBlue 

The introduction of AI in 2024 sparked excitement but overinflated expectations. In cybersecurity, AI struggles to fully adapt to complex threats, remaining reliant on traditional tools and human oversight. In 2025, as customers notice the gap between AI promises and delivery, security teams will refocus on fundamentals. AI will enhance outcomes, but people and processes will remain pivotal in addressing escalating cyber threats.

Burleson-Davis

Joel Burleson-Davis, SVP Worldwide Engineering, Cyber, Imprivata

The attack on American Water, the largest U.S. water utility, highlights the escalating threat to critical infrastructure. Such incidents disrupt essential services, causing economic damage and public safety risks. Prioritizing cybersecurity, particularly in supply chain and third-party systems, is imperative. A holistic approach, combining robust measures, public awareness, and government-private collaboration, is vital to mitigate risks and protect public safety against evolving cyber threats.

chan

Chan

Camellia Chan, CEO, Flexxon

The 2024 CrowdStrike outage was a wake-up call, exposing the risks of overreliance on software-based cybersecurity. It underscored the need to decouple security from operations by embedding hardware-based protections that operate independently of software. This hybrid approach ensures resilience through layered defenses, safeguarding continuity even amid disruptions. The lesson is clear: diversification and strategic separation are key to true cyber resilience.

Schwake

Eric Schwake, Director of Cybersecurity Strategy, Salt Security

The Dell API breach and other 2024 incidents show APIs as prime targets. APIs need comprehensive security strategies: full visibility into all APIs, strong posture governance, continuous monitoring using AI/ML, and leveraging API security platforms for IT system enrichment. Proactive defenses reduce vulnerabilities, improve compliance, and protect assets. By securing APIs throughout their lifecycle, organizations strengthen resilience against evolving threats.

Chearis

Karsten Chearis, US Security Sales Engineer – Team Lead,  XM Cyber

Cybersecurity incidents in 2024 highlighted  the need for resiliency and streamlined operations to avoid tool fatigue. Attackers see one attack surface, so security teams must adopt integrated platforms. Leveraging CTEM frameworks with EDR and SIEM tools allows CISOs to map attack paths, detect threats, and reduce fatigue. Integrated solutions improve efficiency, demonstrate ROI, simplify budget requests, and minimize unnecessary spending while enhancing overall defense capabilities.

Sarkar

Agnidipta Sarkar, CxO Advisor, ColorTokens

In 2024, zero-day exploits targeted browsers, OSs, and network devices, exposing gaps in patch management. Ransomware groups like AlphV, LockBit, and BlackCat used advanced tactics, while misconfigured cloud storage and unsecured data led to major breaches. Many businesses were forced to shut down operations post-attack. As a result, sectors like healthcare and energy are adopting breach-ready defenses, emphasizing microsegmentation to contain impacts and ensure resilience.

Williams

Jake Williams, faculty, IANS Research; VP of R&D, Hunter Strategy

In 2025, nation-state actors will increasingly target network devices like routers and firewalls, exploiting the lack of endpoint detection and response (EDR) software on these devices. Many organizations lack the tools and expertise to detect such threats, creating a significant blind spot. This gap enables attackers to gain network access, disrupt operations, or exploit lawful intercept capabilities, as seen with Salt Typhoon in 2024—a precursor to future threats.

Amlani

Ajay Amlani, President & Head of the Americas, iProov

Remember KnowBe4’s 2024 deepfake hiring scam? In 2025, a larger operation will weaponize synthetic identities, using deepfakes and fake credentials to create convincing personas. These will bypass security, infiltrate payroll systems, steal data, and disrupt operations. This crisis, exploiting remote onboarding vulnerabilities, will force organizations to overhaul identity verification and cybersecurity, underscoring the escalating threat of sophisticated synthetic identity schemes.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

 

 

 

The post LW ROUNDTABLE: Lessons learned from the headline-grabbing cybersecurity incidents of 2024 first appeared on The Last Watchdog.

Uncategorized

The Amazon Web Services (AWS) Shared Responsibility Model has come a long way, indeed.

Related: ‘Shared Responsibility’ best practices

In 2013, Amazon planted a stake in the ground when it divided cloud security obligations between AWS and its patrons, guaranteeing the integrity of its infrastructure, but placing a huge burden on customers to secure things on their end.

For years, misconceptions abounded – especially among small and mid-sized organizations, but also among more than a few marquee enterprises. It was all too easy to assume that moving to AWS equated with outsourcing all security responsibilities.

Not so, of course. High-profile breaches, often stemming from misconfigured services like S3 buckets or exposed APIs, inevitably followed. The 2019 Capital One debacle comes to mind.

Emerging ecosystem

Fast forward to today, and the notion of shared responsibility, when it comes to securing AWS, appears to be steadily gaining meaningful traction. Several drivers have come into play.

For it’s part, Amazon has introduced and promoted a range of tools like AWS Config, GuardDuty, and Security Hub to simplify compliance and improve visibility into cloud environments.

What’s more, third-party cybersecurity vendors have been innovating like crazy to address the obvious gaps. A plethora of advanced tools and services are readily available today; they’re designed to automate best practices and reduce the complexity of managing cloud security tasks.

Meanwhile, the standards bodies and regulators have kept up the pressure for companies to do the right thing, when it comes to cloud security. Frameworks like SOC 2, SOX, and GDPR have forced organizations to take a more proactive approach to account for sensitive data increasing stored and accessed via the cloud.

Last Watchdog engaged Aiman Parvaiz, Director of DevSecOps, at Nimbus Stack, a DevOps consultancy specializing in AWS security, about how the steadily growing momentum of companies living up to their part of Amazon’s shared responsibility requirement. Here’s the gist of our exchange about all of this, edited for clarity and length.

LW: Grasping, much less embracing, ‘Shared Responsibility’ hasn’t been easy for many companies. So what’s changed over the past few years?

Parvaiz

Parvaiz: It’s a combination of factors, really. Companies have learned through experience—especially high-profile breaches—that AWS, while robust, isn’t an out-of-the-box security provider. AWS has also made significant strides in raising awareness about this model, and  the proliferation of third-party tools has reinforced this understanding by providing solutions that help businesses actively manage their security posture.

LW: What should companies come to understand about AWS security tools?

Parvaiz: The key takeaway is that securing their environment is ultimately the company’s responsibility. AWS does provide a rich set of security-focused tools to help with this. WAF and Shield help safeguard public endpoints, while SSM Patch Manager ensures your operating systems remain secure and up to date. Tools like Amazon GuardDuty continuously scan for malicious activity and notify you of anomalies in real time.

LW: Can you frame the state of third-party support?

Parvaiz: The ecosystem of third-party support has grown tremendously in recent years. AWS has built a robust network of partners and vendors, enabling businesses to leverage specialized solutions tailored to their unique needs.

The key to unlocking the full value of third-party tools lies in seamless integration with your existing workflows and infrastructure. When third-party solutions are deeply integrated into your setup—feeding into your monitoring systems, alerting pipelines, and operational processes—they enhance visibility and control, making them actionable and impactful.

LW: What does Nimbus Stack bring to the table?

Parvaiz: At our core, we are a team of seasoned system and cloud engineers dedicated to helping businesses using AWS to fortify their security posture.

We excel at identifying potential threats and mitigating them before they materialize. This expertise is particularly valuable in achieving compliance with standards like SOC 2, FedRAMP, or SOX. Our proactive approach allows us to anticipate auditor focus areas and address compliance hotspots during workload design.

LW: What should companies understand – and anticipate –when it comes to compliance pressures?

Parvaiz: Looking ahead, compliance will shift from being a competitive advantage to a baseline expectation. Integrating security practices and compliance requirements directly into infrastructure management and the software development lifecycle will become essential. Beyond checking boxes for audits, these measures demonstrate a commitment to protecting customer interests, making compliance a critical factor for businesses aiming to grow and remain credible in the market.

LW: Anything else?

Parvaiz: It’s understandable that competing priorities like product development or time-to-market can delay investments in security. That said, strengthening security isn’t a one-time task or a siloed effort—it needs to be embedded across operations and championed by management to be truly effective. Today, robust security isn’t a ‘nice-to-have,’ it’s a ‘must-have’ and the real question is how quickly can you get there?

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the ven

 

 

The post Shared Intel Q&A: A thriving ecosystem now supports AWS ‘shared responsibility’ security model first appeared on The Last Watchdog.