L'Usine Digitale : Pouvez-vous vous présenter ainsi que l’équipe cybersécurité de Zalando ? Florence Mottay : Je suis CISO chez Zalando...

May 30, 2025The Hacker NewsHealthcare / Zero Trust Breaking Out of the Security Mosh Pit When Jason Elrod, CISO of MultiCare Health System, describes legacy healthcare IT environments, he doesn't mince words: "Healthcare loves to walk backwards into the future. And this is how we got here, because there are a lot of things that we could have prepared for that we didn't, because we were so concentrated on where we were." This chaotic approach has characterized healthcare IT for decades. In a sector where lives depend on technology working flawlessly 24/7/365, security teams have traditionally functioned as gatekeepers—the "Department of No"—focused on protection at the expense of innovation and care delivery. But as healthcare continues its digital transformation journey, this approach is no longer sustainable. With 14 hospitals, hundreds of urgent care clinics, and nearly 30,000 employees serving millions of patients, MultiCare needed a different path forward – one that didn't sacrifice innovation for safety. That shift began with a mindset change at the top that was driven by years of experience navigating these exact tensions. Jason Elrod's View: The Healthcare Security Conundrum After 15+ years as a healthcare CISO, Elrod has a unique perspective on the security challenges facing healthcare organizations. According to him, healthcare's specific operational realities create security dilemmas unlike any other industry: Always-on operations: "When can you take it down? When can you stop everything and upgrade it?" asks Elrod. Unlike other industries, healthcare operates 24/7/365 with little room for downtime. Life-or-death access requirements: "We have to make sure all the information they need is available when they need it, with the minimum amount of friction possible. Because it's me, it's you, it's our communities, it's our loved ones, it's life or death." Expanding attack surface: With the shift to telemedicine, remote work, and connected medical devices, the threat landscape has expanded dramatically. "It's like a bowl of spaghetti where each strand needs to be able to talk to one end or the other, but just to the strands it needs to." Misaligned incentives: "IT historically has been concentrated on availability and speed and access, ubiquitous access… And security says, 'That's a fantastic Lego car you built. Before you can go outside and play with it, I'm going to stick a bunch more Legos on top of it called security, privacy, and compliance.'" It's a recipe for burnout, blame, and breakdowns. But what if security could enable care instead of obstructing it? Watch how MultiCare turned that possibility into practice in the Elisity Microsegmentation Platform case study with Jason Elrod, CISO, MultiCare Health System. Identity: The Key to Modern Healthcare Security The breakthrough for MultiCare came with the implementation of identity-based microsegmentation through Elisity. "The biggest attack surface is the identity of every individual," notes Elrod. "Why are the attacks always on identity? Because in healthcare, we must make sure all the information is available when they need it, with the minimum amount of friction possible." Traditional network segmentation approaches relied on complex VLANs, firewalls, and endpoint agents. The result? "A Byzantine spaghetti mess" that became increasingly difficult to manage and update. Elisity's approach changed this paradigm by focusing on identity rather than network location: Dynamic security policies that follow users, workloads, and devices wherever they appear on the network Granular access controls that create security perimeters around individual assets Policy enforcement points that leverage existing infrastructure to implement microsegmentation without requiring new hardware, agents, or complex network reconfigurations From Skepticism to Transformation When Elrod first introduced Elisity to his team, they responded with healthy skepticism. "They're like, 'Did you hit your head? Are you sure you read what you were saying? I thought you stopped drinking,'" Elrod recalls. The technical teams were doubtful that such a microsegmentation solution could work with their existing infrastructure. "They said, 'That doesn't sound like something that can be done,'" shares Elrod. But seeing was believing. "When you see people who are deeply technical, people who just know their craft really well, and they see something and go 'Wow'… it shakes the pillars of their opinions about what can be done," explains Elrod. The Elisity solution delivered on its promises: Rapid implementation without disruptive network changes Real-time automated or manual policy adjustments that previously took weeks to implement Comprehensive visibility across previously siloed environments Enhanced security posture without compromising availability ...all without forcing a tradeoff between protection and performance. But what surprised Elrod most wasn't just what the technology did, but how it changed the people using it.[JE2] Breaking Down Walls Between Teams Perhaps the most unexpected benefit was how the solution transformed relationships between teams. "There's been a friction point. Put this control and constraint around the network. Who's the first person to call? They're going to call IT. 'I can't do this thing.' And I'm saying, 'Well, you can't open everything, because everybody can't have everything. Because the bad guys will have everything then,'" Elrod explains. Identity-based microsegmentation changed this dynamic: "It changed from 'How do I get around you?' and 'How do you get around me?' to cooperation. Because now it's like, 'Oh, well, let's make that change together.' It shifted culturally, and this was not something I expected… We really are on the same team. This is a solution that works for all of us, makes all of our jobs better, Security and IT. It is a force multiplier across the organization," says Elrod. With Elisity, security and IT teams now share incentives rather than competing priorities. "The same thing that allows me to make connectivity work between this area and here in a frictionless fashion is also the same exact thing that provides the rationalized security around it. Same tool, same dashboard, same team," Elrod notes. Enabling a Culture of Yes For healthcare providers, the impact is profound. "If they don't have to worry about access, don't have to worry about the controls, they can take the cognitive load of thinking and worrying about the compliance factors of it, the security, the privacy, the technology underlying the table that they're working on," says Elrod. This shift enables a fundamental change in how security interacts with clinical staff: Speed of delivery: "We can do that at the speed of need as opposed to the speed of bureaucracy, the speed of technology, the speed of legacy," explains Elrod. Granular control: "How would you like your own segment on the network, wherever you may roam? I can base it on your identity, wherever you're at," Elrod shares. Enhanced trust: "Being able to instill that confidence that, 'Hey, it's secure, it's stable, it's scalable, it's functional, we can support it. And we can move at the pace that you want to move at.'" Breaking Down Silos: The Business Imperative of Security-IT Integration The traditional separation between security and IT operations teams is rapidly becoming obsolete as organizations recognize the strategic advantages of integration. Recent research demonstrates compelling business benefits for enterprises that successfully bridge this divide, particularly for those in manufacturing, industrial, and healthcare sectors. According to Skybox Security (2025), 76% of organizations believe miscommunication between network and security teams has negatively impacted their security posture. This disconnect creates tangible security risks and operational inefficiencies. Conversely, organizations with unified security and IT operations reported 30% fewer significant security incidents compared to those with siloed teams. For healthcare organizations, the stakes are even higher. Among healthcare institutions that experienced ransomware attacks, those with siloed security and IT operations reported a 28% increase in patient mortality rates in 2024, up from 23% in 2023 (Ponemon Institute & Proofpoint, 2024). This stark reality underscores that cybersecurity integration isn't just an operational consideration—it's a patient safety imperative. The financial case for integration is equally compelling. A Forrester Total Economic Impact study on ServiceNow Security Operations solutions demonstrated a 238% ROI and $6.2 million in present value benefits, with a 6-month payback period when integrating security and IT operations (Forrester/ServiceNow, 2024). Forward-thinking organizations are adopting sophisticated integration models like Cyber Fusion Centers. Gartner research confirms these represent a significant advancement over traditional security operations, predicting that by 2028, 20% of large enterprises will shift to cyber-fraud fusion teams to combat internal and external adversaries, up from less than 5% in 2023. For enterprise leaders, the message is clear: breaking down operational silos between security and IT teams isn't just good practice—it's essential for comprehensive protection, operational efficiency, and competitive advantage in today's threat landscape. Few understand that better than Elrod, who's spent decades trying to bridge this gap both technologically and culturally. The Bridge to Modern Healthcare For Elrod, identity-based microsegmentation represents more than just a technology solution—it's a bridge between where healthcare has been and where it needs to go. "Technology in the past wasn't bought because it was crappy… They were great. Good intention. They did what they needed to do at the time. But there's a lot of temporal distance between now and when that made sense," he explains. Elisity helps MultiCare "build that bridge from where we have been to where we need to go… It's a ladder out of the pit. This is great. Let's stop throwing things in there. Let's actually do things in a rational fashion," says Elrod. Looking Ahead While no single solution can address all of healthcare's security challenges, identity-based microsegmentation is "one of the bricks on the yellow brick road to making healthcare security and technology the culture of Yes," according to Elrod. As healthcare organizations continue to balance security requirements with the need for frictionless care delivery, solutions that align these competing priorities will become increasingly essential. By implementing identity-based microsegmentation, MultiCare has transformed security from a barrier to an enabler of modern healthcare—proving that with the right approach, it's possible to create a culture where "yes" is the default response without compromising security or compliance. Ready to escape your own security "mosh pit" and build a bridge to modern healthcare? Download Elisity's Microsegmentation Buyer's Guide 2025. This resource equips healthcare security leaders with evaluation criteria, implementation strategies, and ROI frameworks that have helped organizations like MultiCare transform from the "Department of No" to a "Culture of Yes." Begin your journey toward identity-based security today. To learn more about Elisity and how we help transform healthcare organizations like MultiCare, visit our website here. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

Carrie Pallardy, Contributing ReporterMay 29, 20255 Min ReadWilliam Mullins via Alamy StockJohn Deere hired its first CISO in 2014, and James Johnson has remained in that role at the agricultural equipment company to this day. Johnson sat down with InformationWeek to talk about how he got started in his career, why working through a nation state attack was pivotal to his love of security, and how John Deere is building a talent of pipeline in the time of the cybersecurity skills gap.  From Network Engineer to Chief Information Security Officer Johnson started his career as a network engineer at windows and doors company Pella. He loved working in the network space but soon realized that he might grow bored there given enough time.  Derek Benz, a friend of Johnson’s and now CISO of Coca-Cola, suggested looking into security. Johnson went out and got a Certified Information Systems Security Professional (CISSP) certification, which helped him land a job as a pen tester at manufacturing and technology company Honeywell.  During his time at Honeywell, the company was hit by Titan Rain, a series of coordinated cyberattacks carried out by a Chinese APT.  James Johnson, CISO“Getting a chance to see how nation states target companies and what they’re capable of doing, I think really made the mission even more important to me at that point,” Johnson shares. “When you do have the nation-state attack early on your career, it’s kind of a game changer … just thinking about the value of the work that you're doing and why it matters.” Related:He spent 11 years at Honeywell, steadily working up the ranks to become a CISO overseeing various divisions within the company. And then, a call came from John Deere.  John Deere’s First CISO That call came at the right time. Johnson had reached a point at Honeywell where his growth would likely be limited for a period of time.  “I was pleasantly surprised by the opportunity,” says Johnson. “I had a great connection to John Deere coming out of Iowa, growing up in the farming community, seeing a lot of that … great brand and an opportunity to really build something that from scratch again.” While building a security program as a first-time CISO is an exciting opportunity, it comes with its challenges. When Johnson arrived, he noticed how trusting the culture was at John Deere. “It’s a great value that John Deere has … they really try to strive to do the right thing with integrity, but that’s not the way the world operates on the digital front,” he says. One of his mentors early on in his tenure at John Deere told him that he was going to have work on shifting the entire company culture as he built his security organization.  Related:And he has made strides. When he first got there, everyone was using relatively simple passwords. Yet, the process to change those passwords was cumbersome and time-consuming.  “Today, MFA is deployed across the company. We have complex passwords,” he says. “We're trying to find ways to use biometrics more.” An Evolving Role His responsibilities in the CISO role have grown over time. When he first joined, he was overseeing IT security and operations. Financial product security, data security and governance; his team have taken on more and more over time.  “We built the program from about 32 people to … 220 people strong now in our organization,” he says.  Johnson has been with John Deere for more than a decade. Not every CISO or CIO sticks with the same company for that long, but Johnson has found that longevity has its benefits. He has built relationships with the board and his C-suite peers “It's pretty hard to get good at something in two or three years,” he explains. “You’re there longer. You’ve got the relationships. You’ve got the ability to influence things and really make a bigger difference.” Today, he is working alongside John Deere’s leadership to navigate the thrilling possibilities and security concerns of AI.  Related:Building a Talent Pipeline While the possibility of a security incident always looms in a CISO’s mind, Johnson is thinking about talent, too. “We will not succeed without the right people in our organization driving the right change,” he says.  John Deere is taking multiple approaches to bringing the right people to his team. First, he looks to other teams for people who are experts and not necessarily in security. He looks for promising talent and asks, “Can I teach that person security?” And the answer to that question in many cases has been “yes.” “We’ve got folks who used to be lead engineers on the product side who now are running our product security department, and they were never interested in security at all,” he says. John Deere also makes use of cyber talent through its bug bounty program, which has paid out more than $1.5 million since 2022.  Having been a pen tester, Johnson knows how frustrating it can be for someone to discover a vulnerability only for a company to do nothing to fix it. “We have service-level agreements to get certain vulnerabilities that are critical, high, medium, low, fixed within a certain period of time, and in most cases, we beat those numbers,” he says.  John Deere also works with Iowa State University to cultivate talent. “We put some services on campus, part of their tech center, that are services you probably would never get a chance to really work with or learn in college,” says Johnson.  He knows it would be difficult to find cloud security experts, for example, so they are helping develop those experts at Iowa State. “We’ve built a pipeline of talent out of Iowa State University because they know our brand,” says Johnson.  About the AuthorCarrie PallardyContributing ReporterCarrie Pallardy is a freelance writer and editor living in Chicago. She writes and edits in a variety of industries including cybersecurity, healthcare, and personal finance.See more from Carrie PallardyWebinarsMore WebinarsReportsMore ReportsNever Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.SIGN-UPYou May Also Like

Carrie Pallardy, Contributing ReporterMay 29, 20255 Min ReadWilliam Mullins via Alamy StockJohn Deere hired its first CISO in 2014, and James Johnson has remained in that role at the agricultural equipment company to this day. Johnson sat down with InformationWeek to talk about how he got started in his career, why working through a nation state attack was pivotal to his love of security, and how John Deere is building a talent of pipeline in the time of the cybersecurity skills gap.  From Network Engineer to Chief Information Security Officer Johnson started his career as a network engineer at windows and doors company Pella. He loved working in the network space but soon realized that he might grow bored there given enough time.  Derek Benz, a friend of Johnson’s and now CISO of Coca-Cola, suggested looking into security. Johnson went out and got a Certified Information Systems Security Professional (CISSP) certification, which helped him land a job as a pen tester at manufacturing and technology company Honeywell.  During his time at Honeywell, the company was hit by Titan Rain, a series of coordinated cyberattacks carried out by a Chinese APT.  James Johnson, CISO“Getting a chance to see how nation states target companies and what they’re capable of doing, I think really made the mission even more important to me at that point,” Johnson shares. “When you do have the nation-state attack early on your career, it’s kind of a game changer … just thinking about the value of the work that you're doing and why it matters.” Related:He spent 11 years at Honeywell, steadily working up the ranks to become a CISO overseeing various divisions within the company. And then, a call came from John Deere.  John Deere’s First CISO That call came at the right time. Johnson had reached a point at Honeywell where his growth would likely be limited for a period of time.  “I was pleasantly surprised by the opportunity,” says Johnson. “I had a great connection to John Deere coming out of Iowa, growing up in the farming community, seeing a lot of that … great brand and an opportunity to really build something that from scratch again.” While building a security program as a first-time CISO is an exciting opportunity, it comes with its challenges. When Johnson arrived, he noticed how trusting the culture was at John Deere. “It’s a great value that John Deere has … they really try to strive to do the right thing with integrity, but that’s not the way the world operates on the digital front,” he says. One of his mentors early on in his tenure at John Deere told him that he was going to have work on shifting the entire company culture as he built his security organization.  Related:And he has made strides. When he first got there, everyone was using relatively simple passwords. Yet, the process to change those passwords was cumbersome and time-consuming.  “Today, MFA is deployed across the company. We have complex passwords,” he says. “We're trying to find ways to use biometrics more.” An Evolving Role His responsibilities in the CISO role have grown over time. When he first joined, he was overseeing IT security and operations. Financial product security, data security and governance; his team have taken on more and more over time.  “We built the program from about 32 people to … 220 people strong now in our organization,” he says.  Johnson has been with John Deere for more than a decade. Not every CISO or CIO sticks with the same company for that long, but Johnson has found that longevity has its benefits. He has built relationships with the board and his C-suite peers “It's pretty hard to get good at something in two or three years,” he explains. “You’re there longer. You’ve got the relationships. You’ve got the ability to influence things and really make a bigger difference.” Today, he is working alongside John Deere’s leadership to navigate the thrilling possibilities and security concerns of AI.  Related:Building a Talent Pipeline While the possibility of a security incident always looms in a CISO’s mind, Johnson is thinking about talent, too. “We will not succeed without the right people in our organization driving the right change,” he says.  John Deere is taking multiple approaches to bringing the right people to his team. First, he looks to other teams for people who are experts and not necessarily in security. He looks for promising talent and asks, “Can I teach that person security?” And the answer to that question in many cases has been “yes.” “We’ve got folks who used to be lead engineers on the product side who now are running our product security department, and they were never interested in security at all,” he says. John Deere also makes use of cyber talent through its bug bounty program, which has paid out more than $1.5 million since 2022.  Having been a pen tester, Johnson knows how frustrating it can be for someone to discover a vulnerability only for a company to do nothing to fix it. “We have service-level agreements to get certain vulnerabilities that are critical, high, medium, low, fixed within a certain period of time, and in most cases, we beat those numbers,” he says.  John Deere also works with Iowa State University to cultivate talent. “We put some services on campus, part of their tech center, that are services you probably would never get a chance to really work with or learn in college,” says Johnson.  He knows it would be difficult to find cloud security experts, for example, so they are helping develop those experts at Iowa State. “We’ve built a pipeline of talent out of Iowa State University because they know our brand,” says Johnson.  About the AuthorCarrie PallardyContributing ReporterCarrie Pallardy is a freelance writer and editor living in Chicago. She writes and edits in a variety of industries including cybersecurity, healthcare, and personal finance.See more from Carrie PallardyWebinarsMore WebinarsReportsMore ReportsNever Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.SIGN-UPYou May Also Like

Are your web privacy controls protecting your users, or just a box-ticking exercise? This CISO's guide provides a practical roadmap for continuous web privacy validation that's aligned with real-world practices. – Download the full guide here. Web Privacy: From Legal Requirement to Business Essential As regulators ramp up enforcement and users grow more privacy-aware, CISOs face a mounting challenge: ensuring that what their organization says about privacy matches what their digital assets are doing. 70% of top US websites still drop advertising cookies even when users opt out, a clear contradiction of privacy claims. This gap exposes organizations to compliance failures, reputational damage, and user distrust. A Practical Approach to Web Privacy Validation Drawing from real-world incidents and regulatory trends, this guide outlines how CISOs can integrate continuous privacy validation into their security operations and explains why it's becoming a foundational practice. Reactive vs Proactive Web Privacy Programs Most privacy programs rely on static audits and ineffective cookie banners, but these are poorly suited for today's dynamic web. The modern web has made these techniques obsolete and elevated the role of continuous monitoring—it's now essential for maintaining regulatory compliance. Reliance on the old reactive approach leads to silent privacy drift, which can trigger: Unauthorized data collection: For example, a new marketing pixel silently collecting user IDs, or a third-party script tracking behavior that strays outside of the stated policy. Broken consent mechanisms: Cookie consent that resets after updates, or embedded content dropping cookies before the user consents. Non-compliance: A form update unintentionally collecting extra, undisclosed personal data; an AI chatbot processing queries without the required transparency. Brand damage: Users noticing an unexpected widget accessing location data without their clear consent. The takeaway: Privacy risks are hiding in plain sight. A proactive approach is more likely to hunt them down before any damage is done. Reactive vs Proactive Privacy Programs: Scenario Comparison Aspect/ Scenario Reactive Privacy Program (Traditional) Proactive Privacy Program (Continuous Validation) Approach Periodic, manual audits and static compliance checks. Continuous, automated monitoring and validation in production. Detection of New Risks New scripts, vendors, or third-party tools may go unnoticed for months. Every page load and code change is scanned for new trackers/scripts. Time to Discovery Weeks or months—typically only found after user complaints or a regulator inquiry. Minutes or hours—automated alert triggers immediate investigation. Regulatory Risk High: Undetected issues can lead to major fines and investigations. Low: Issues are caught early, reducing exposure and demonstrating diligence. Remediation Validation Fixes are assumed to work, but rarely verified in production. Automated validation confirms that remediations are effective. Resource Efficiency High manual effort, prone to oversight (issues can be missed) and burnout. Automated workflows free up teams for higher-value tasks. Adaptation to New Regulations Scrambles to keep up; often playing catch-up with new laws and frameworks. Agile response; continuous validation meets evolving requirements. Scenario Walkthrough: The Leaky Script Step Reactive Program Proactive Program Script added to website No immediate detection Detected instantly as a new third-party element. Data leakage begins Continues for months, often unnoticed. Alert issued; data flow flagged as policy violation. Discovery Discovered only after complaints or regulatory inquiry. Privacy team investigates within hours of the alert. Response Scramble to contain, investigate, and report; faces regulatory fines. Issue remediated quickly, minimizing exposure and risk. Outcome €4.5M fine, public backlash, loss of trust. No fine, incident averted, trust preserved. Download the full CISO's guide here. What Is Website Privacy Validation? Website Privacy Validation tools shift privacy from reactive to proactive by continuously monitoring your websites, applications, and third-party code live in production. This ensures that your real-world activity aligns with your declared policies. Key capabilities: Continuous Data Mapping, Policy Matching, Instant Alerts, Fix Validation, and Dashboard Oversight. Why Continuous Validation Is the New Standard Only 20% of companies feel confident in their privacy compliance, but continuous validation removes doubt. It strengthens compliance, simplifies audits, and integrates into existing security workflows, thanks to agentless deployment of some vendors that minimizes operational overhead. Case in Point: The Cost of Inaction A global retailer launched a loyalty program, but unknown to them, it included a third-party script that was sending customer emails to an external domain. This went undetected for four months and eventually led to a €4.5 million fine, public backlash, and a loss of executive trust. With privacy validation, the issue could have been resolved in hours, not months, and all that expensive fallout could have been avoided. Much like the global retailer, providers in both the healthcare and financial services industries have opened themselves up to serious repercussions after failing to proactively validate web privacy. For instance, a hospital network neglected to validate the third-party analytics scripts running on its site, which left them free to silently collect patient data without consent. This violated HIPAA regulations, risked fines, and damaged patient trust. Similarly, a bank suffered a data breach when a third-party vendor added a tracking script that accessed sensitive account information without proper authorization. In both cases, web privacy validation could have immediately flagged these issues, preventing unauthorized data collection, avoiding legal repercussions, and preserving customer trust across these highly regulated sectors. Get Ready for 2025's Tougher Regulations New frameworks like the EU AI Act and New Hampshire's NHPA are changing how organizations approach privacy. CISOs now face unprecedented validation requirements, including: Comprehensive AI risk assessments with continuous algorithm transparency Advanced consent mechanisms that dynamically respond to signals like Global Privacy Control Rigorous safeguards for sensitive data processing across all digital touchpoints Mandatory documentation and technical validation of privacy controls Cross-border data transfer mechanisms that withstand increasing scrutiny The regulatory landscape isn't just evolving—it's accelerating, so organizations that implement continuous web privacy validation now will be strategically positioned to navigate these complex requirements while their competitors are scrambling to catch up. Don't Wait for a Violation Before You Take Action Explore actionable steps and real-world examples in the full CISO's Guide to Web Privacy Validation. → Download the full CISO's Guide to Web Privacy Validation here. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post.

Apple’s approach to building new features has always been rooted in safety and seamless convenience. Take, for example, AirPlay, a wireless standard created by the company that allows users to stream audio and video from one device to another. AirPlay works not just across Apple devices, but also on TVs and speakers cleared by the company to offer the wireless streaming facility. That also makes it a ripe target for attacks, and it seems there are, in fact, vulnerabilities in the wireless lanes that could allow bad actors to seed malware and infect more connected devices.  Recommended Videos Understanding the AirPlay risk Experts at the security research firm Oligo recently detailed Airborne, a set of flaws in Apple’s AirPlay Protocol and the AirPlay Software Development Kit (SDK) that can allow hackers to remotely execute code. These vulnerabilities can let bad actors take control of devices and use the infected machines to broaden the damage.  “An attacker can take over certain AirPlay-enabled devices and do things like deploy malware that spreads to devices on any local network the infected device connects,” Oligo explained. The risk is huge because there are billions of Apple devices out there that support AirPlay, and millions that are sold by other brands.  Simon Cohen / Digital Trends One of the vulnerabilities could allow hackers to compromise a device and then use it to gain access to a larger network, potentially targeting other devices, too. Depending on the target, the risks range from spying on conversations to tracking a car’s location, accessing sensitive information, ransomware attacks, and denial of service.  Apple has patched the vulnerabilities via macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4 updates. However, there are potentially thousands of older devices that will never get patched and remain vulnerable.  What steps do experts suggest? Of course, the first line of defense to protect yourself across all vulnerable devices is to download the fix released by Apple. But that isn’t the full picture. Trevor Horwitz, CISO and founder of TrustNet, says the patch will only work if people install it after the package downloads on their device. “The simplest and most effective thing you can do is keep your devices updated. That sounds basic, but it’s often overlooked,” he says. On an iPhone or iPad, follow this route to install the safety update: Settings > General > Software Update. For macOS, you must walk this path: Apple menu > System. Settings > General > Software Update. Nadeem Sarwar / Digital Trends Since attack vectors like Airborne rely on Wi-Fi networks to expand their damage, you must also pay attention to them. Oleh Kulchytskyi, Senior Malware Reverse Engineer at MacPaw’s Moonlock, told DigitalTrends that a Zero-Click Remote Code Execution (RCE) is the highest level of security breach.  It should be immediately patched by the companies involved, but as a user, one must take further network-related precautions. “To stay safe at home, ensure that your router has a strong password and there are no suspicious connections to your network,” Kulchytsky adds.   A safe way to AirPlay Matthias Frielingsdorf, a veteran iOS researcher and cofounder of iVerify, tells me that everyone should follow basic digital security protocols. Those include installing updates as soon as they are available, maintaining strong network passwords, and most importantly, reducing the surface area for such attacks.  Since AirPlay is the threat vector, users should take proactive steps while using it. ”Disabling this on iOS / macOS / tvOS devices that don’t need to be an AirPlay receiver would limit some of the attacks. In public spaces, disabling WiFi on the Mac and iPhone would stop those attacks as well,” says Frielingsdorf.  Nadeem Sarwar / Digital Trends AirPlay streaming is active by default, and as such, you need to disable it. To do so, follow this path on your iPhone or iPad: Settings  > General > AirPlay & Continuity > Ask. You can also set it to Never, if you don’t actively utilize this feature. There’s also an option to set a password, which I recommend that you enable, while at it. What about AirPlay itself? Can it be disabled? Yes, it can be turned off entirely. On your iPhone and iPad, go to the AirPlay & Continuity page and turn off the AirPlay Receiver toggle. Alternatively, you can choose to allow AirPlay only for the Current User, instead of keeping it open to everyone in the range.  For Mac users, this is the path you need to follow: Apple Menu > System Settings > General > AirDrop & Handoff > AirPlay Receiver. You can’t always patch older or discontinued devices, so it’s best to ensure that the machines that are currently in your hands have enabled the right protocols to minimize the risks.  The bottom line  On multiple occasions in the past, security experts have highlighted flaws in wireless transmission systems, such as Bluetooth. But a vulnerability that allows zero-click remote code execution in AirPlay is a cautionary tale. The message is clear. Apple’s security guardrails are solid, but not impenetrable. “What makes this serious is the integration. AirPlay isn’t just a standalone app. It’s a system-level service built into iOS, macOS, and tvOS. So the moment that layer is compromised, the attacker could potentially affect multiple devices at once,” TrustNet’s Horwitz told Digital Trends.  Nadeem Sarwar / Digital Trends So, where does that leave an average user who is not savvy about security measures? Well, it’s time to set aside notions and market perceptions. Chris Hill, Chief Security Strategist at BeyondTrust, says users must understand the threat landscape instead of living with the idea that a certain ecosystem is safer than the rest.  “Threat actors are opportunistic, looking for the easiest path of least resistance, they will find it, and they did in this case with AirPlay and AirBorne,” he warns. The bottom line is that keep your devices updated, disable features you don’t use, and be vigilant with network-related settings.

May 20, 2025The Hacker NewsPenetration Testing / Risk Management In the newly released 2025 State of Pentesting Report, Pentera surveyed 500 CISOs from global enterprises (200 from within the USA) to understand the strategies, tactics, and tools they use to cope with the thousands of security alerts, the persisting breaches and the growing cyber risks they have to handle. The findings reveal a complex picture of progress, challenges, and a shifting mindset about how enterprises approach security testing. More Tools, More Data, More Protection… No Guarantees Over the past year, 45% of enterprises expanded their security technology stacks, with organizations now managing an average of 75 different security solutions​. Yet despite these layers of security tools, 67% of U.S. enterprises experienced a breach in the past 24 months​. The growing number of deployed tools has a few effects on the daily operation and the overall cyber posture of the organization. Although it seems obvious, the findings tell a clear story - more security tools do mean better security posture. However, there is no silver bullet. Among organizations with fewer than 50 security tools, 93% reported a breach. That percentage steadily declines as stack size increases, dropping to 61% among those using more than 100 tools. Alert Fatigue Is Real The flip side of larger security stacks is that CISOs and their teams must contend with a much larger influx of information. Enterprises managing over 75 security solutions now face an average of 2,000 alerts per week — double the volume compared to organizations with smaller stacks, and those with over 100 tools receive over 3000 (3x the alerts). This in turn, puts much more emphasis on effective prioritization, otherwise, critical threats may get buried in a sea of alerts. In this environment, where alert volumes are high and time to triage is short, organizations benefit most when they can frequently test for exploitable gaps, so they know which issues truly matter before threat actors find them first. Software-Based Pentesting Gains Ground Trust in software-based security testing is growing rapidly. Only 5-10 years ago, many enterprises would never have permitted automated tools to run pentests in their environments for fear of causing outages, but sentiment is changing. As CISOs continue to recognize the advantages of software in scaling adversarial testing and keeping pace with constantly changing IT environments, software-based pentesting is becoming the standard. Over half of enterprises now use these tools to support in-house testing, driven by trust in their reliability and the need for scalable, continuous validation strategies. Today, 50% of CISOs cite software-based pentesting solutions as their primary method for uncovering exploitable gaps​. Insurance Providers Become Unexpected Influencers Beyond internal management and Boards of Directors, a surprising new force is shaping security strategy: Cyber insurance providers. 59% of CISOs admitted that they have implemented at least one cybersecurity solution that they were not previously considering as a result of their cyber insurers. It's a clear sign that insurers aren't just pricing risk, they're actively prescribing how to reduce it, and reshaping enterprise security priorities in the process.​. Low Confidence in Government Support While governmental agencies like CISA (in the US) and ENISA (in the EU) play an important role in threat visibility and coordination, confidence in government cybersecurity support is surprisingly low. Only 14% of CISOs believe the government is adequately supporting the private sector's cyber challenges​, while 64% feel that government efforts, though acknowledged, are insufficient​. 22% believe that they cannot rely on the government at all for cybersecurity help. To benchmark your organization's pentesting practices, budgets, and priorities against other global enterprises, register for the webinar on May 27, 2025 where senior security analysts will discuss the key findings. Alternatively, get the full 2025 State of Pentesting Report and see all the insights for yourself!Note: This article was written and contributed by Jay Mar Tang, Field CISO at Pentera. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

May 19, 2025The Hacker NewsRisk Management / Threat Detection Continuous Threat Exposure Management (CTEM) has moved from concept to cornerstone, solidifying its role as a strategic enabler for CISOs. No longer a theoretical framework, CTEM now anchors today's cybersecurity programs by continuously aligning security efforts with real-world risk. At the heart of CTEM is the integration of Adversarial Exposure Validation (AEV), an advanced, offensive methodology powered by proactive security tools including External Attack Surface Management (ASM), autonomous penetration testing and red teaming, and Breach and Attack Simulation (BAS). Together, these AEV tools transform how enterprises proactively identify, validate, and reduce risks, turning threat exposure into a manageable business metric. CTEM reflects a broader evolution in how security leaders measure effectiveness and allocate resources. As board expectations grow and cyber risk becomes inseparable from business risk, CISOs are leveraging CTEM to drive measurable, outcome-based security initiatives. Early adopters report improved risk visibility, faster validation and remediation cycles, and tighter alignment between security investments and business priorities.1 With tools like ASM and autonomous pentesting delivering real-time insights into exposure, CTEM empowers CISOs to adopt a continuous, adaptive model that keeps pace with attacker techniques and the evolving threat landscape. CTEM's Moment Has Arrived CTEM introduces a continuous, iterative process encompassing three pillars: Adversarial Exposure Validation (AEV), Exposure Assessment Platforms (EAP), and Exposure Management (EM). These methodologies ensure enterprises can dynamically assess and respond to threats, aligning security efforts with business objectives.1 Gartner underscores the significance of CTEM, predicting that by 2026, organizations prioritizing security investments based on a CTEM program will be three times less likely to suffer a breach.2 Adversarial Exposure Validation (AEV): Simulating Real-World Threats AEV strengthens CTEM by continuously validating the effectiveness of security controls through the simulated exploitation of assets using real-world attacker behaviors. This often involves the use of automation, AI, and machine learning to replicate tactics, techniques, and procedures (TTPs) used by adversaries, helping enterprises to proactively identify exploitable exposures before they can be leveraged in an actual attack. This proactive approach is crucial in understanding weaknesses and refining defenses more effectively. Attack Surface Management (ASM): Expanding Visibility ASM complements CTEM by providing comprehensive visibility into an enterprise's digital footprint. By continuously discovering, prioritizing, and monitoring assets, ASM enables security teams to identify potential vulnerabilities and exposures promptly. This expanded visibility is essential for effective threat exposure management, ensuring that no asset remains unmonitored. AEV transforms ASM from a map into a mission plan, and enterprises need it urgently. Autonomous Penetration Testing and Red Teaming: Improving Scalability The integration of autonomous penetrating testing and red teaming into CTEM frameworks marks a significant advancement in cybersecurity practices. Autonomous pentesting, for example, delivers real-time, scalable, and actionable insights unlike periodic assessments. This shift enhances operational efficiency while proactively identifying and mitigating vulnerabilities in real-time. While regulatory compliance remains important, it is no longer the sole driver – modern mandates increasingly emphasize continuous, proactive security testing. Breach and Attack Simulation (BAS): Continuous Security Validation BAS tools also play a role in CTEM by automating the simulation of known attack techniques across the kill chain – ranging from phishing and lateral movement to data exfiltration. Unlike autonomous pentesting, which actively exploits vulnerabilities, BAS focuses on continuously validating the effectiveness of security controls without causing disruption. These simulated attacks help uncover blind spots, misconfigurations, and detection and response gaps across endpoints, networks, and cloud environments. By aligning results with threat intelligence and frameworks like MITRE ATT&CK, BAS enables security teams to prioritize remediation based on real exposure and risk, helping CISOs ensure their defenses are not only in place, but operationally effective. The Impetus Behind CTEM's Rise The rapid adoption of CTEM in 2025 is no coincidence. As cyber risks grow more complex and dynamic, enterprises are embracing CTEM not just as a framework, but as an effective cyber strategy that yields measurable results. Several converging trends, ranging from evolving threat tactics to regulatory pressure and expanding digital footprints, are driving security leaders to prioritize continuous validation, real-time visibility, and operational efficiency across the attack surface. Several factors contribute to the widespread adoption of CTEM: Scalability: The rapid shift to cloud-native architectures, growing supply chain, and interconnected systems has expanded the attack surface. CTEM delivers the visibility and control needed to manage this complexity at scale. Operational Efficiency: By integrating tools and automating threat validation, CTEM reduces redundancy, streamlines workflows, and accelerates response times. Measurable Outcomes: CTEM enables CISOs to shift from abstract risk discussions to data-driven decisions by providing clear metrics on exposure, control effectiveness, and remediation progress, supporting better alignment with business objectives and board-level reporting. Regulatory Compliance: With rising enforcement of cybersecurity regulations like NIS2, DORA, and SEC reporting mandates, CTEM's continuous validation and visibility help enterprises stay compliant and audit ready. Conclusion Cybersecurity cannot evolve by standing still, and neither can security leaders and their organizations. The shift toward a proactive, measurable, and continuous approach to threat exposure is not only necessary but achievable. In fact, it's the only viable path forward. CTEM isn't just another framework, it's a blueprint for transforming security into a business-aligned, data-driven discipline. By embracing real-time validation, prioritizing exposures that matter, and proving effectiveness with metrics that resonate beyond the SOC, CISOs are moving the industry beyond checkboxes toward true resilience. Today, the enterprises that lead in cybersecurity will be the ones that measure it and manage it, continuously. About BreachLock: BreachLock is a leader in offensive security, delivering scalable and continuous security testing. Trusted by global enterprises, BreachLock provides human-led and AI-assisted attack surface management, penetration testing services, red teaming, and Adversarial Exposure Validation (AEV) services that help security teams stay ahead of adversaries. With a mission to make proactive security the new standard, BreachLock is shaping the future of cybersecurity through automation, data-driven intelligence, and expert-driven execution. References: Hacking Reviews. (n.d.). How attack surface management supports continuous threat exposure management. Retrieved 30, April 2025, from https://www.hacking.reviews/2023/05/how-attack-surface-management-supports.htmlGartner. (n.d.). How to Manage Cybersecurity Threats, Not Episodes. Retrieved 30, April 2025, from https://www.gartner.com/en/articles/how-to-manage-cybersecurity-threats-not-episodes Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    