# Practitioner guidance from IANS Faculty

Evergreen, first-hand cybersecurity how-tos and analysis — written by the practitioners who do the work.

## Latest articles

[Understanding the OT-ICS Threat Landscape Ransomware groups rarely attack OT and ICS networks, but nation-states do. Here is why, and how OT cybersecurity teams can tell spying from attack preparation. Oct 21, 20266 min read Jake Williams Read more](https://www.ians.com/blog/understanding-the-ot-ics-threat-landscape) [AI Is Reshaping the Security Org Chart New benchmark data shows how security teams are structured and how AI is changing leadership roles and accountability. Findings are split by company revenue. Oct 19, 20261 min read Read more](https://www.ians.com/blog/ai-is-reshaping-the-security-org-chart) [How Security Organizations Are Evolving: 5 Key Findings for CISOs Explore five findings from the 2026 IANS and Artico Search report on security staffing, leadership roles, AI security, and outsourcing, by company size. Oct 19, 20265 min read Read more](https://www.ians.com/blog/how-security-organizations-are-evolving-5-key-findings-for-cisos)

[Best Practices for Preventing Social Media Account Takeover How to prevent social media account takeover. Turn on platform security settings, stop sharing passwords, watch for fake accounts, and plan your response. Oct 14, 20265 min read Caroline Wong Read more](https://www.ians.com/blog/best-practices-for-preventing-social-media-account-takeover) [Security Awareness Training That Actually Changes Behavior How to run security awareness training that changes behavior. Plan your Cybersecurity Awareness Month, engage employees, and measure what really changed. Oct 8, 20269 min read Masha Sedova Read more](https://www.ians.com/blog/security-awareness-training-that-actually-changes-behavior) [Network Segmentation Best Practices, Pressure-Tested How to apply network segmentation best practices with real penetration testing. Test like an attacker, avoid common mistakes, and know when to retest. Oct 1, 20268 min read Dave Shackleford Read more](https://www.ians.com/blog/network-segmentation-best-practices-pressure-tested)

[How AI Is Expected to Shape Security Budgets in 2027 See how rising AI investment is expected to change cybersecurity spending in 2027, including software, automation, staffing, and security skills. Sep 30, 20264 min read Read more](https://www.ians.com/blog/how-ai-is-expected-to-shape-security-budgets-in-2027) [Is Your Security Budget Ready for AI? See the 2026 security budget and AI investment data shaping how CISOs plan for 2027, from the IANS and Artico Search benchmark report. Sep 14, 20261 min read Read more](https://www.ians.com/blog/is-your-security-budget-ready-for-ai) [Security Budgets Stall as AI Reshapes 2027 Spending Security budgets remain tight heading into 2027, but AI investments, board priorities, and uneven budget growth are changing how CISOs lobby for new funding. Sep 14, 20264 min read Read more](https://www.ians.com/blog/security-budgets-stall-as-ai-reshapes-2027-spending)

[Managing AI Risk Today Won't Fully Prepare You for Tomorrow AI security controls aren't enough. New CISO data shows what separates organizations managing today's risks from those ready for what comes next. Sep 10, 20264 min read Read more](https://www.ians.com/blog/managing-ai-risk-today-wont-fully-prepare-you-for-tomorrow) [AI Controls Reduce Risk. Organizational Readiness Builds Confidence. New data from IANS and Artico Search reveal two distinct challenges: managing AI risk today and preparing to manage it tomorrow. Aug 25, 20261 min read Read more](https://www.ians.com/blog/ians-research/ai-controls-reduce-risk-organizational-readiness-builds-confidence) [AI Governance Is Advancing While the Attack Surface Expands Why AI governance progress hasn't kept pace with the expanding attack surface AI introduces, based on a new IANS and Artico Search survey of 113 CISOs. Aug 25, 20264 min read Read more](https://www.ians.com/blog/ians-research/ai-governance-is-advancing-while-the-attack-surface-expands)

[How Banking Security Can Get Ahead of Cyber Threats How banking security teams can stay ahead of emerging cyber threats, as 62% report deepfake incidents averaging nearly $500,000 in losses. Jul 20, 20264 min read Read more](https://www.ians.com/blog/ians-research/how-banking-security-can-get-ahead-of-cyber-threats) [Can AI Improve Security Decisions? It Depends on Your Data IANS MCP brings practitioner and peer intelligence into AI tools like Claude, grounding security decisions in real, proven guidance. Jul 15, 20264 min read Read more](https://www.ians.com/blog/ians-mcp-practitioner-validated-ai-answers) [IANS Security Signal: Manufacturing Insights from nearly 280 conversations reveal where manufacturing CISOs are focusing their security efforts today. Jul 1, 20261 min read Read more](https://www.ians.com/blog/ians-research/ians-security-signal-manufacturing)

[Prep for CISA's New Patch Requirements and Timelines Required actions and timelines organizations need to follow to comply with CISA's new patch directive, Binding Operational Directive 26-04. Jun 26, 20264 min read Jake Williams Read more](https://www.ians.com/blog/prep-for-cisas-new-patch-requirements-and-timelines) [How Banking CISOs Are Getting Ahead of Third-Party Risk in 2026 How banking CISOs are getting ahead of third-party risk in 2026, drawing on nearly 290 interactions between banking security leaders and IANS Faculty. Jun 24, 20264 min read Read more](https://www.ians.com/blog/ians-research/how-banking-cisos-are-getting-ahead-of-third-party-risk-in-2026) [The Cybersecurity Skills Gap Isn't What You Think The 2026 IANS Cybersecurity Talent Report reveals why broad skills and business fluency matter more than deep security specialization. Jun 22, 20263 min read Read more](https://www.ians.com/blog/ians-research/the-cybersecurity-skills-gap-isnt-what-you-think)

[AI Governance for Banking CISOs: How to Catch Up Banking CISOs are behind on AI governance, and business stakeholders and regulators are already asking. Learn which moves to make now before your exam window. Jun 8, 20263 min read Read more](https://www.ians.com/blog/ians-research/ai-governance-for-banking-cisos-how-to-catch-up) [The 2026 Cybersecurity Talent Crisis Is Already Here: Ready for It? Only 34% of cybersecurity professionals plan to stay with their employer, according to the 2026 IANS Talent Snapshot Report on pay and retention. May 26, 20263 min read Read more](https://www.ians.com/blog/ians-research/the-2026-cybersecurity-talent-crisis-is-already-here-ready-for-it) [IANS Security Signal: Banking Data from more than 290 conversations reveals where banking CISOs are focusing their security programs right now. May 20, 20261 min read Read more](https://www.ians.com/blog/ians-research/ians-security-signal-banking)

[Reflections on RSAC 2026: Key Takeaways and Infosec Trends IANS Senior Directors of Research Nick Kakolowski and Gina Glendening reflect on key infosec takeaways and trends they saw at RSAC Conference 2026. May 1, 20266 min read Nick Kakolowski and Gina Glendening Read more](https://www.ians.com/blog/ians-research/reflections-on-rsac-2026-key-takeaways-and-infosec-trends) [Introducing IANS News and an AI-Enhanced Platform Experience for Security Leaders IANS News and Ask IANS combine practitioner-led insights and AI search to help security leaders focus on what matters and act with confidence. Apr 16, 20264 min read Paul Henderson Read more](https://www.ians.com/blog/ians-research/introducing-ians-news-and-an-ai-enhanced-platform-experience-for-security-leaders) [U.S. Cyber Strategy: A Private Sector Call to Action How the U.S. Cyber Strategy for America makes cybersecurity a board-level priority, and what executives must do on AI defense, risk, and workforce. Apr 6, 20264 min read Lee Kim Read more](https://www.ians.com/blog/us-cyber-strategy-a-private-sector-call-to-action)

[AI is Raising the Bar for Security Teams in 2026 Learn how CISOs are using AI to automate SecOps, improve team performance, and keep pace with AI-enabled threat actors, per IANS' AI Heading into 2026 report. Mar 26, 20263 min read Read more](https://www.ians.com/blog/ians-research/ai-is-raising-the-bar-for-security-teams-in-2026) [Boards Give CISO Cybersecurity Reporting a Mixed Grade New data shows boards rate CISO updates as strong on today's cyber risk but weak on emerging threats and AI risk. Here's what the numbers reveal. Mar 24, 20263 min read Read more](https://www.ians.com/blog/ians-research/boards-give-ciso-cybersecurity-reporting-a-mixed-grade) [Using AI to Turn Security Metrics into Board-Ready Insights IANS Faculty member Jessica Hebenstreit on how security teams can use AI to translate jargon-heavy metrics into clear, board-ready insights. Mar 12, 20261 min read Jessica Hebenstreit Read more](https://www.ians.com/blog/ians-research/using-ai-to-turn-security-metrics-into-board-ready-insights)

[AI Agents Are Creating an Identity Security Crisis in 2026 AI agents generate thousands of nonhuman identities that operate at machine speed. Learn why CISOs say this is a top identity and access challenge. Feb 24, 20262 min read Read more](https://www.ians.com/blog/ians-research/ai-agents-are-creating-an-identity-security-crisis-in-2026) [The Dark Side of Innovation: Seeing the Whole Picture Learn more about the duality of technology, including how every innovation brings both benefits and risks, and why cybersecurity is essential. Feb 24, 20261 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/ians-research/the-dark-side-of-innovation-seeing-the-whole-picture) [CISOs Lead the AI Governance Challenge The 2026 AI Report combines IANS community poll data with hard-won lessons from CISOs on the front lines of AI adoption. Feb 11, 20261 min read Read more](https://www.ians.com/blog/ians-research/cisos-lead-the-ai-governance-challenge)

[The CISO's Expanding AI Mandate: Leading Governance in 2026 CISOs are emerging as AI governance leaders in 2026, moving beyond security gatekeepers to strategic partners who balance innovation with risk. Feb 6, 20263 min read Read more](https://www.ians.com/blog/ians-research/the-cisos-expanding-ai-mandate-leading-governance-in-2026) [Build a Cloud Forensics Practice How to build a cloud forensics practice, including five playbook types for storage, database, IaaS, container, and control-plane incidents. Feb 2, 20267 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/build-a-cloud-forensics-practice) [The Retail CISO Reality: Broad Scope, Limited Slack How retail security leaders in consumer-facing organizations can adjust their posture, priorities, and operating model for the year ahead. Feb 2, 20263 min read Read more](https://www.ians.com/blog/ians-research/the-retail-ciso-reality-broad-scope-limited-slack)

[How Tabletop Exercises Transform Incident Response Readiness Learn how incident response tabletop exercises help organizations uncover gaps, improve readiness, and prepare teams for real-life cyber incidents. Jan 29, 20261 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/how-tabletop-exercises-transform-incident-response-readiness) [The CISO Paradox: Rising Status, Growing Strain The 2026 State of the CISO research reveals a paradox: CISOs hold more executive influence than ever, even as their scope grows harder to manage. Jan 26, 20261 min read Read more](https://www.ians.com/blog/ians-research/the-ciso-paradox-rising-status-growing-strain) [The Business Enabler Every CISO Needs to Succeed CISOs and security leaders can elevate their impact by linking cybersecurity initiatives directly to the company's mission, vision, and values. Jan 20, 20261 min read Russell Eubanks Read more](https://www.ians.com/blog/ians-research/the-business-enabler-every-ciso-needs-to-succeed)

[Strengthen Ransomware Resilience with IANS Tabletop Exercises IANS Faculty member AJ King on how quarterly tabletop exercises bringing together executive and technical teams strengthen cyber preparedness. Jan 15, 20261 min read AJ King Read more](https://www.ians.com/blog/ians-research/strengthen-ransomware-resilience-with-ians-tabletop-exercises) [Zero Trust: More Than a New Year's Resolution Making zero trust a daily practice is not just a resolution. Learn why ongoing commitment, not one-off goals, is key to effective security. Jan 6, 20261 min read Jason Garbis Read more](https://www.ians.com/blog/ians-research/zero-trust-more-than-a-new-years-resolution) [Security in 2026: What Leaders Need to Know Security priorities for 2026: AI to counter faster attacks, phishing-resistant MFA, non-human identities, insider threat programs, training, and flat budgets. Dec 30, 20252 min read Read more](https://www.ians.com/blog/ians-research/security-in-2026-what-leaders-need-to-know)

[Quantum Computing: What It Is, and Isn't A grounded look at what quantum computing can realistically do today and where the hype outpaces reality. Dec 23, 20251 min read Read more](https://www.ians.com/blog/ians-research/quantum-computing-what-it-is-and-isn-t) [The Looming 2026 Challenge: Failed AI Deployments Why so many corporate AI initiatives fail to deliver ROI, and what that means for CISOs weighing AI investments. Dec 18, 20251 min read Read more](https://www.ians.com/blog/ians-research/the-looming-2026-challenge-failed-ai-deployments) [A Strategic Approach to Cybersecurity Assessments How emerging technologies are helping organizations escape the cycle of assessment fatigue and outdated processes. Dec 16, 20253 min read Read more](https://www.ians.com/blog/ians-research/a-strategic-approach-to-cybersecurity-assessments)

[Building Security Into Developer Workflows How pre-built, security-approved building blocks help developers stay secure without slowing down innovation. Dec 9, 20252 min read Read more](https://www.ians.com/blog/ians-research/building-security-into-developer-workflows) [Why AI Pushes CISOs to Rethink Production Data Policies AI model training needs production data; AI processes can use synthetic data. Raise training environments to production controls and delete data after training. Dec 2, 20253 min read Read more](https://www.ians.com/blog/ians-research/why-ai-forces-cisos-to-rethink-production-data-policies) [The CISO Pay Gap: Inside Cybersecurity's Massive Compensation Divide CISO salary and total pay from 566 CISOs: most earn $250,000 to $700,000, the top 1% start at $3.2 million, and equity, industry, and scale drive the gap. Nov 13, 20252 min read Read more](https://www.ians.com/blog/ians-research/the-ciso-pay-gap-inside-cybersecuritys-massive-compensation-divide)

[AI-Powered Cyberattacks: What's Real, What's Hype? AI-powered cyberattacks are increasing in scale, not sophistication. Learn what's real, what's hype, and how security leaders should respond. Nov 11, 20254 min read Jake Williams Read more](https://www.ians.com/blog/ai-powered-cyberattacks-what-s-real-what-s-hype) [Achieving Resilience Through Zero Trust Why resilience, not just prevention, has become the goal as technical defenses alone are no longer sufficient. Nov 4, 20254 min read Read more](https://www.ians.com/blog/ians-research/achieving-resilience-through-zero-trust) [Make Cybersecurity Awareness a Daily Habit, Not Just an October Initiative Practical cybersecurity awareness tips and best practices to help your workforce stay secure during Awareness Month and all year round. Oct 28, 20254 min read Lee Kim Read more](https://www.ians.com/blog/make-cybersecurity-awareness-a-daily-habit-not-just-an-october-initiative)

[The Evolution of Security Organization Design: A Maturity Roadmap for CISOs How security orgs mature, from midsize teams of 3 to 15 FTEs to Fortune 500 teams of 50+, with staff budget splits by function and the rise of deputy CISOs. Oct 16, 20252 min read Read more](https://www.ians.com/blog/ians-research/the-evolution-of-security-organization-design-a-maturity-roadmap-for-cisos) [8 Tips to Prepare for Quantum Computing and Post-Quantum Cryptography Eight steps to prepare for post-quantum cryptography, from valuing long-lived data and inventorying your cryptography to PKI readiness and federal deadlines. Oct 7, 20255 min read Read more](https://www.ians.com/blog/ians-research/8-tips-to-prepare-for-quantum-computing-and-post-quantum-cryptography) [How to Establish an Effective Data Governance Committee How to build a data governance committee that turns data quality and privacy problems into a strategic advantage, and the common pitfalls to avoid. Oct 1, 20253 min read Russell Okoth Read more](https://www.ians.com/blog/how-to-establish-an-effective-data-governance-committee)

[Building a Zero Trust Roadmap That Delivers Business Value Zero trust implementation roadmap: the five-step protect surface process, CISA ZTMM pillars and maturity levels, and tying in IAM and cloud migration work. Sep 30, 20253 min read Read more](https://www.ians.com/blog/ians-research/building-a-zero-trust-roadmap-that-delivers-business-value) [10 Cybersecurity Training Tips for Security Awareness Month 2025 Ten security awareness training tips for 2025: teach home and work security, cover AI deepfakes, run year-round, build champions, and measure behavior change. Sep 25, 20253 min read Read more](https://www.ians.com/blog/ians-research/10-cybersecurity-training-tips-for-security-awareness-month-2025) [How to Balance Opportunity and Risk With AI Tools in the SOC Why CISOs must evaluate AI tools for SOC workflows carefully to avoid introducing new risks while reducing alert fatigue. Sep 23, 20252 min read Read more](https://www.ians.com/blog/ians-research/how-to-balance-opportunity-and-risk-with-ai-tools-in-the-soc)

[How CISOs Are Using Platforms and MSSPs to Stretch Security Budgets Benchmark research shows CISOs are consolidating tools and leaning on MSSPs to scale capabilities without overspending. Sep 18, 20253 min read Read more](https://www.ians.com/blog/ians-research/how-cisos-are-using-platforms-and-mssps-to-stretch-security-budgets) [Preparing for the Quantum Shift in Cybersecurity Why security leaders can't wait for quantum computing to fully arrive before addressing its threat to encryption. Sep 16, 20252 min read Read more](https://www.ians.com/blog/ians-research/preparing-for-the-quantum-shift-in-cybersecurity) [CISOs Face Tough Challenges as Budgets Tighten: Trends in Security Software Spend New benchmark data shows software now commands about 30% of the average security budget as spending pressure grows. Sep 10, 20253 min read Read more](https://www.ians.com/blog/ians-research/cisos-face-tough-challenges-as-budgets-tighten-trends-in-security-software-spend)

[How to Navigate Insider Threats in the Age of AI AI insider threats span over-reliance on AI output, shadow AI, prompt injection, data poisoning, and deepfakes, plus the governance and monitoring to curb them. Sep 4, 20253 min read Read more](https://www.ians.com/blog/ians-research/how-to-navigate-insider-threats-in-the-age-of-ai) [How to Set Up a Strong GRC Program Core components of a GRC program: assess maturity in eight areas, from roles and legal requirements to vendor risk, then build on NIST CSF 2.0 or COBIT 2019. Sep 2, 20257 min read Rebecca Herold Read more](https://www.ians.com/blog/ians-research/how-to-set-up-a-strong-grc-program) [What Is the Ideal CISO Reporting Structure? CISO reporting structures compared: the pros and cons of reporting to the CIO, CEO, or other executives, with 2025 data on how many CISOs report to the CEO. Aug 26, 20257 min read Read more](https://www.ians.com/blog/ians-research/what-is-the-ideal-ciso-reporting-structure)

[GRC Trends for 2025: Building Resilient Programs for the Future How governance, risk, and compliance is shifting in 2025 from a check-the-box function into a strategic enabler of resilience and growth. Aug 21, 20253 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/grc-trends-for-2025-building-resilient-programs-for-the-future) [How to Build a Successful Insider Threat Program: Focus on Intelligence Build an insider threat program that works: an HR-led, legally guided, cross-functional approach grounded in governance and process, not just tools. Aug 19, 20254 min read Jake Williams Read more](https://www.ians.com/blog/how-to-build-a-successful-insider-threat-program-focus-on-intelligence) [What Are the Top Security Budget Spend Priorities? 2025 security budget benchmark from 587 CISOs: staff takes 39% and software 29%, with SecOps leading software spend at 16%, endpoint at 12%, and cloud at 11%. Aug 14, 20253 min read Read more](https://www.ians.com/blog/ians-research/what-are-the-top-security-budget-spend-priorities)

[How to Build an Effective Insider Threat Program Why an effective insider threat program must be cross-functional and HR-led, with InfoSec, legal, and business units working under one charter. Aug 12, 20254 min read Dave Shackleford Read more](https://www.ians.com/blog/how-to-build-an-effective-insider-threat-program) [Security Budgets Under Pressure: How CISOs Can Navigate Tight Budget Constraints 2025 data from 587 CISOs: security budget growth fell to 4%, security's share of IT spend dropped to 10.9%, and staff growth hit a four-year low of 7%. Aug 5, 20254 min read Read more](https://www.ians.com/blog/ians-research/security-budgets-under-pressure-how-cisos-can-navigate-tight-budget-constraints) [Enhancing Cyber Resilience: Leveraging AI and External Service Providers How to strengthen cyber resilience when talent is scarce, using external service providers and AI to block threats early and ease the load on your team. Jul 29, 20254 min read Alex Sharpe Read more](https://www.ians.com/blog/enhancing-cyber-resilience-leveraging-ai-and-external-service-providers)

[Tips to Accelerate the Secure Adoption of Agentic AI How CISOs can secure agentic AI adoption with strong governance, nonhuman identity management, and operational controls that limit risk. Jul 22, 20254 min read Jason Robbins Read more](https://www.ians.com/blog/tips-to-accelerate-the-secure-adoption-of-agentic-ai) [How to Create Effective Executive InfoSec Dashboards How to build an executive cybersecurity dashboard that tells your security story with concrete, trending, and actionable data, plus tips on content and layout. Jul 10, 20254 min read Jessica Hebenstreit Read more](https://www.ians.com/blog/ians-research/how-to-create-effective-executive-infosec-dashboards) [Utility Company Saves $1.7M With an Open-Source Security Strategy A utility company saved about $1.7 million by resolving years of conflict between business and security teams and meeting contract needs with open-source tools. Jul 8, 20252 min read Read more](https://www.ians.com/blog/ians-research/utility-company-saves-1-7m-with-an-open-source-security-strategy)

[How to Effectively Use AI A practical GIVE PETS TREATS framework that helps everyday users work with AI tools more deliberately, accurately, and efficiently. Jul 1, 20256 min read Josh More Read more](https://www.ians.com/blog/how-to-effectively-use-ai) [Is Your Identity Framework Ready for Agentic AI? AI agents form a third identity class that legacy IAM was never built for. How to govern agent lifecycle and permissions, and find shadow AI. Jun 30, 20253 min read Taryn Swietek Read more](https://www.ians.com/blog/is-your-identity-framework-ready-for-agentic-ai) [Why Cloud Security Operations Demand a New Mindset: A Guide for Executives Why moving to the cloud amplifies, rather than reduces, the need for strong internal security operations. Jun 26, 20254 min read Read more](https://www.ians.com/blog/ians-research/why-cloud-security-operations-demand-a-new-mindset-a-guide-for-executives)

[How to Apply the Three Lines of Defense Understand how the three lines of defense model works and how to allocate risk work across operational, tactical, and strategic teams. Jun 24, 20258 min read Josh More Read more](https://www.ians.com/blog/how-to-apply-the-three-lines-of-defense) [How IANS Helped a Client Build a Zero-Trust Program How ongoing support from IANS Faculty member Wolfgang Goerlich helped a client build an award-winning zero-trust program from strategy to implementation. Jun 19, 20252 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/how-ians-helped-a-client-build-a-zero-trust-program) [How Do You Compare? 2025 Comp and Budget Data for Small and Midmarket CISOs 2025 data for CISOs at firms under $1B in revenue: a $3.4M average security budget, 37% spent on staff, $415K average total pay, and what drives satisfaction. Jun 17, 20254 min read Read more](https://www.ians.com/blog/ians-research/how-do-you-compare-2025-comp-and-budget-data-for-small-and-midmarket-cisos)

[How to Establish GRC Practices for AI Why AI needs its own GRC playbook, and how to govern the risks across models, data, inputs, outputs, users, and infrastructure through training and inference. Jun 12, 20256 min read Alex Sharpe Read more](https://www.ians.com/blog/how-to-establish-grc-practices-for-ai) [What You Need to Know: Digging Deep Into DeepSeek How security leaders should evaluate and manage the risks of adopting DeepSeek-R1, the AI reasoning model from China. Jun 3, 20254 min read Read more](https://www.ians.com/blog/ians-research/what-you-need-to-know-digging-deep-into-deepseek) [2025 Large Enterprise CISO Snapshot: Higher Compensation, Lower Satisfaction Large enterprise CISOs average $700,000 in total pay ($1.1 million at $20B+ firms) and 10 years of tenure, yet low satisfaction keeps many open to new jobs. May 29, 20255 min read Read more](https://www.ians.com/blog/ians-research/2025-large-enterprise-ciso-snapshot-higher-compensation-lower-satisfaction)

[Reflections on RSAC 2025: Key Takeaways and Infosec Trends IANS research directors share their takeaways from RSAC 2025, where more than 44,000 security professionals gathered. May 28, 20256 min read Read more](https://www.ians.com/blog/ians-research/reflections-on-rsac-2025-key-takeaways-and-infosec-trends) [How to Structure the Information Security Function How to structure an information security team: size it to your worst risks, set its scope, decide where it reports, and staff and resource the function. May 27, 202513 min read Rich Guida Read more](https://www.ians.com/blog/ians-research/how-to-structure-the-information-security-function) [How to Deal with Individuals Who Repeatedly Fail Phishing Simulations Why employees keep failing phishing tests: 6% of users caused over 29% of failures. Fixes: a four-strikes rule, root-cause analysis, rewards, and gamification. May 22, 20257 min read Summer Craze Fowler Read more](https://www.ians.com/blog/ians-research/how-to-deal-with-individuals-who-repeatedly-fail-phishing-simulations)

[How to Streamline Vendor Selection How CISOs can run smarter proof-of-concept evaluations, ask the right vendor questions, and build transparent, long-term security partnerships. May 15, 20254 min read AJ King Read more](https://www.ians.com/blog/how-to-streamline-vendor-selection) [Tech Sector Sees Compensation Gaps and Expanding Roles New benchmark data shows tech sector CISO compensation growth alongside broadening scope of responsibility. May 8, 20253 min read Read more](https://www.ians.com/blog/ians-research/tech-sector-sees-compensation-gaps-and-expanding-roles-access-key-data-and-trends) [Tips to Build an AI Governance Team How to build a cross-disciplinary AI governance team, the roles to include, and best practices for governing AI safely and responsibly. Apr 28, 20254 min read Lee Kim Read more](https://www.ians.com/blog/tips-to-build-an-ai-governance-team)

[How to Reduce Third-Party Security Risks How security leaders can navigate and reduce risk across an increasingly interconnected vendor ecosystem. Apr 24, 20254 min read Read more](https://www.ians.com/blog/ians-research/how-to-reduce-third-party-security-risks) [Tips to Prevent Quantum Computing Encryption Data Breaches Can quantum computers break encryption? How quantum computing threatens public-key and symmetric encryption, and how post-quantum standards reduce the risk. Apr 17, 20257 min read Read more](https://www.ians.com/blog/ians-research/tips-to-prevent-quantum-computing-encryption-data-breaches) [How to Manage Open-Source Software Securely A practitioner's guide to using open-source software securely: licensing, dependencies, shadow-IT detection, patching, and the metrics that matter. Apr 10, 20257 min read Josh More Read more](https://www.ians.com/blog/how-to-manage-open-source-software-securely)

[How to Navigate the Oracle Cloud Incident: Key Steps to Take Key steps security teams should take after the 2025 Oracle Cloud breach, which exposed 6 million records across more than 140,000 tenants. Apr 3, 20253 min read Jake Williams Read more](https://www.ians.com/blog/how-to-navigate-the-oracle-cloud-incident-key-steps-to-take) [Healthcare Security Comp and Budgets Decline: Access Key Report Data and Trends Healthcare security budget growth slowed to 4% in 2024, and healthcare CISOs earn 10% to 40% less than peers in other industries. Key 2025 benchmark data. Mar 27, 20254 min read Read more](https://www.ians.com/blog/ians-research/healthcare-security-comp-and-budgets-decline-access-key-report-data-and-trends) [Key Financial Services Security Staffing Impacts in 2025 Financial services security budgets reached 12% of IT spend in 2024, yet nearly half of CISOs can't add staff in 2025. Staff costs already take 39% of budgets. Mar 6, 20254 min read Read more](https://www.ians.com/blog/ians-research/key-financial-services-security-staffing-impacts-in-2025)

[How to Strengthen OT Security Against Manufacturing Ransomware Attacks How OT security differs from IT for manufacturers facing ransomware: legacy devices, Purdue zones, and availability first. Set alert owners before buying tools. Feb 27, 20255 min read Read more](https://www.ians.com/blog/ians-research/how-to-strengthen-ot-security-against-manufacturing-ransomware-attacks) [Solve Staff Hiring and Retention Issues: The Cybersecurity Staff Comp Report Is Live New benchmark data on cybersecurity staff compensation aims to help CISOs address talent shortages and retention risk. Feb 20, 20254 min read Read more](https://www.ians.com/blog/ians-research/solve-staff-hiring-and-retention-issues-the-cybersecurity-staff-comp-report-is-live) [Key Financial Services Security Budget Impacts in 2025 Financial services security budgets grew 8% in 2024 (about 5% after inflation), breaches and industry disruption drove the biggest increases, and hiring slowed. Jan 28, 20253 min read Read more](https://www.ians.com/blog/ians-research/key-financial-services-security-budget-impacts-in-2025)

[Build CISO Strategic Impact and Visibility: State of the CISO, 2025 is Live! IANS and Artico Search's State of the CISO, 2025 report reveals how the CISO role is evolving in scope, influence, and board engagement. Jan 14, 20254 min read Read more](https://www.ians.com/blog/ians-research/build-ciso-strategic-impact-and-visibility-state-of-the-ciso-2025-is-live) [Scale and Build a Resilient Security Team How CISOs can shape security org structure, hierarchy and staffing to scale as the business evolves. Nov 14, 20243 min read Read more](https://www.ians.com/blog/ians-research/scale-and-build-a-resilient-security-team-the-leadership-and-org-report-is-live) [How to Mitigate Your Risk as a CISO CISOs carry personal liability as well as organizational risk. Guidance on legal counsel, insurance, indemnification and reducing personal exposure. Sep 25, 20245 min read Lee Kim Read more](https://www.ians.com/blog/how-to-mitigate-your-risk-as-a-ciso)

[2024 Security Budget Benchmark Report: Key Findings 2024 security budget data from 681 CISOs: budgets grew 8% (about 5% after inflation), breaches drove the biggest increases, and staff growth slowed to 12%. Sep 5, 20242 min read Read more](https://www.ians.com/blog/ians-research/2024-security-budget-benchmark-report-key-findings) [Vendor Consolidation: Identifying Overlaps and Maximizing Value Vendor consolidation: spot overlaps at selection and in periodic reviews, price true costs to onboard and maintain, then weigh switching or doing it yourself. Aug 1, 20245 min read Josh More Read more](https://www.ians.com/blog/ians-research/vendor-consolidation-identifying-overlaps-and-maximizing-value) [Understand the Evolving Privacy and Regulatory Landscape How evolving privacy laws and regulations are forcing organizations to rethink data collection and management. Jul 18, 20244 min read Alex Sharpe Read more](https://www.ians.com/blog/ians-research/understand-the-evolving-privacy-and-regulatory-landscape)

[Evolve Security Architecture: Prep for the Future How security architecture is evolving: deeper cloud and IAM skills, automation and API integration, shift-left and zero trust controls, and consultative roles. Jul 2, 20244 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/evolve-security-architecture-prep-for-the-future) [Build an Effective BCDR Plan for the Cloud BCDR best practices for migrating to the cloud, covering resilience, RTOs and RPOs, common pitfalls, testing KPIs and treating BCDR as a program. Jun 27, 20248 min read Mike Saurbaugh Read more](https://www.ians.com/blog/build-an-effective-bcdr-plan-for-the-cloud) [RSAC 2024: Key Takeaways and InfoSec Trends RSAC 2024 takeaways: infosec burnout, unmet AI vendor promises, compliance burdens, the Universal Cloud Threat Model, and zero trust for backup and recovery. Jun 24, 20245 min read Read more](https://www.ians.com/blog/ians-research/rsac-2024-key-takeaways-and-infosec-trends)

[Key Takeaways From the Snowflake Security Incidents The 2024 Snowflake incidents came from stolen passwords on accounts without MFA. Reset passwords, require MFA, limit network access, and check your vendors. Jun 5, 20244 min read Jake Williams Read more](https://www.ians.com/blog/key-takeaways-from-the-snowflake-security-incidents) [Tips to Negotiate Higher Pay CISO pay negotiation tips: flag the risk of underpaying staff, elevate your brand, widen your network, and build business acumen and executive presence. Apr 25, 20241 min read Read more](https://www.ians.com/blog/ians-research/tips-to-negotiate-higher-pay) [Prioritize Security Projects for Leadership: Build a Risk Impact Matrix How to use an effort vs. impact matrix to prioritize security projects, explain each project's risk impact to leadership, and reprioritize as resources change. Apr 18, 20244 min read Read more](https://www.ians.com/blog/ians-research/prioritize-security-projects-for-leadership-build-a-risk-impact-matrix)

[Tips for Advancing Your GRC Program How to build a cross-functional task force and use risk management components to flesh out a GRC program. Apr 3, 20243 min read Joshua Marpet Read more](https://www.ians.com/blog/ians-research/tips-for-advancing-your-grc-program) [IANS Faculty 2024 Cyber Predictions: Security Market Hiring Trends An IANS Faculty member predicts hiring will rebound in 2024 as the economy improves after a difficult stretch. Mar 26, 20241 min read Read more](https://www.ians.com/blog/ians-research/ians-faculty-2024-cyber-predictions-security-market-hiring-trends) [Address the Top Objections to Zero Trust in Healthcare Common stakeholder objections to zero trust in healthcare and effective strategies for overcoming them. Mar 19, 20245 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/address-the-top-6-objections-to-zero-trust-in-healthcare)

[How to Identify and Develop Staff for Senior Infosec Roles The criteria that determine whether an individual is ready for promotion or advancement on a security team. Mar 5, 20247 min read Anand Singh Read more](https://www.ians.com/blog/ians-research/how-to-identify-staff-for-senior-infosec-roles) [Comp, Budget and Satisfaction for CISOs in Financial Services: Benchmark Report New survey data on compensation, budgets and satisfaction levels for CISOs in the financial services sector. Feb 29, 20242 min read Read more](https://www.ians.com/blog/ians-research/comp-budget-and-satisfaction-for-cisos-in-financial-services-benchmark-report-is-live) [Key Infosec Staffing Insights: The Cybersecurity Staff Compensation Report Is Live! Cybersecurity staff pay data from 563 practitioners: how experience, education, company size, and gender affect pay, and how CISOs can attract and keep staff. Feb 29, 20243 min read Read more](https://www.ians.com/blog/ians-research/key-infosec-staffing-insights-the-cybersecurity-staff-comp-report-is-live)

[Why Building a Cloud-Specific IR Playbook Is Critical Why cloud environments need detection and response playbooks distinct from on-premises incident response plans. Feb 21, 20245 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/why-building-a-cloud-specific-ir-playbook-is-critical) [AI Governance: Tech Problems Without Tech Solutions AI is a technology problem without a technology solution. Guiding leadership principles for governing AI adoption and managing its risks safely. Feb 15, 20245 min read Alex Sharpe Read more](https://www.ians.com/blog/ai-governance-tech-problems-without-tech-solutions) [Use NIST to Secure Baseline Configurations and Mitigate Risk How to tailor a secure baseline configuration with NIST SP 800-128 and a risk assessment, so controls fit your environment without overclassifying your data. Feb 13, 20245 min read Joshua Marpet Read more](https://www.ians.com/blog/ians-research/use-nist-to-secure-baseline-configurations-and-mitigate-risk)

[Ensure a Smooth Transition to New Security Leadership Why good succession planning and documentation help an infosec program survive unexpected leadership turnover. Feb 8, 20245 min read Lee Kim Read more](https://www.ians.com/blog/ians-research/ensure-a-smooth-transition-to-new-security-leadership) [The Role of SBOMs, Segmentation and Access Controls in Supply Chain Security How software bills of materials, segmentation and access restrictions help secure the software supply chain, using Log4j as a cautionary example. Feb 7, 20244 min read Joshua Marpet Read more](https://www.ians.com/blog/the-role-of-sboms-segmentation-and-access-controls-in-supply-chain-security) [IANS 2024 Cyber Predictions: Storm Attacks and Ransomware An IANS Faculty member predicts continued large-scale storm attacks and ransomware events against critical environments. Feb 6, 20241 min read Read more](https://www.ians.com/blog/ians-research/ians-faculty-2024-cyber-predictions-storm-attacks-and-ransomware)

[Guidance to Overcome the Cybersecurity Talent Shortage The factors driving the ongoing gap between open cybersecurity roles and qualified talent, and how to address it. Jan 31, 20246 min read Read more](https://www.ians.com/blog/ians-research/guidance-to-overcome-the-cybersecurity-talent-shortage) [CISO Challenges in Data Security: Best Practices for Privacy Compliance Common privacy compliance challenges CISOs face, the consequences of a weak data protection program, and core best practices to stay compliant. Jan 25, 20245 min read Rebecca Herold Read more](https://www.ians.com/blog/ciso-challenges-in-data-security-best-practices-for-privacy-compliance) [Understand New Privacy Laws: Guidance for Organizations During Data Privacy Week, Rebecca Herold explains why organizations lag on new privacy laws and shares best practices to make compliance efficient. Jan 23, 20244 min read Rebecca Herold Read more](https://www.ians.com/blog/understand-new-privacy-laws-guidance-for-organizations)

[IANS Faculty 2024 Cyber Predictions: SaaS Market Trends An IANS Faculty member predicts consolidation in the SaaS market as larger security companies acquire smaller ones. Jan 18, 20241 min read Read more](https://www.ians.com/blog/ians-research/ians-faculty-2024-cyber-predictions-saas-market-trends) [State of the CISO, 2023-2024: Benchmark Report Available Now New benchmark data on CISO compensation, budgets and job satisfaction amid tightening budgets and new SEC mandates. Jan 17, 20242 min read Read more](https://www.ians.com/blog/ians-research/state-of-the-ciso-2023-2024-benchmark-report-is-live) [AI and Third Parties: How to Hold Vendors Accountable How to manage third-party AI risk: questions to ask vendors about their AI use, extending your AI policy to them, and contract language that protects your data. Jan 11, 20244 min read Joshua Marpet Read more](https://www.ians.com/blog/ians-research/ai-and-third-parties-how-to-hold-vendors-accountable)

[IANS 2024 Cyber Predictions: ChatGPT Uncovers Zero-Day Vulnerabilities An IANS Faculty member predicts how AI tools like ChatGPT will be used to discover zero-day vulnerabilities in 2024. Jan 9, 20241 min read Read more](https://www.ians.com/blog/ians-research/ians-2024-cyber-predictions) [IANS 2024 Cyber Predictions: AI APIs Will Increase Security Risks 2024 API security prediction: ChatGPT and low-code tools will drive a surge in APIs, while AI-produced code leaves them unsecured and exposes back-end systems. Jan 3, 20241 min read Read more](https://www.ians.com/blog/ians-research/2024-cyber-predictions-apis) [Cookie Security Checklist: Lock Down Your Data Cookie security checklist: set Secure and HttpOnly flags, limit persistence with Expires or Max-Age, scope Domain and Path, and prefer SameSite=Strict over Lax. Dec 27, 20232 min read Read more](https://www.ians.com/blog/ians-research/cookie-security-checklist)

[Determine the Impact and Cost of Security Breaches How a security incident differs from a breach, and a step-by-step way to estimate breach costs, from business disruption and fines to legal and brand impacts. Dec 19, 20237 min read Mike Saurbaugh Read more](https://www.ians.com/blog/ians-research/cost-and-impact-of-a-security-breach) [SEC Cyber Disclosure Requirements: CISO Summary Checklist A summary of the SEC's new rules requiring public companies to disclose material cybersecurity incidents within four days. Dec 14, 20231 min read Read more](https://www.ians.com/blog/ians-research/2023-sec-cyber-disclosure-guidance) [New CISO Priority Checklist: Ensure a Fast, Successful Start New CISO checklist for the first 30 days, six months, and year: charter, risk register, NIST CSF 2.0 baseline, strategic roadmap, and SSO for all cloud access. Nov 30, 20236 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/new-ciso-priority-checklist)

[InfoSec Org Design Guidance: Benchmark Report Is Live How security org design scales with revenue: 2023 data from 660 CISOs on when SecOps, GRC, A&E, AppSec, and deputy CISO leadership roles become standard. Nov 15, 20232 min read Read more](https://www.ians.com/blog/ians-research/2023-infosec-org-guidance) [Tailor Your Definition of 'Incident' to Your Organization What is an incident in cybersecurity? NIST, FS-ISAC, FDIC, and Verizon define it differently, so adapt your ISAC's definition and apply it consistently. Nov 9, 20234 min read Kenneth van Wyk Read more](https://www.ians.com/blog/ians-research/tailor-your-definition-of-incident-to-your-organization) [Best Practices to Manage and Reduce Phishing Risk How to measure the spread of phishing risk across employees, benchmark click rates against tests of similar difficulty, and manage your highest-risk employees. Nov 7, 20235 min read Masha Sedova Read more](https://www.ians.com/blog/best-practices-to-manage-and-reduce-phishing-risk)

[Build Metrics That Resonate With Multiple Audiences How to build a security metrics program that aligns with operational, tactical and strategic stakeholder needs. Nov 2, 20234 min read Shannon Lietz Read more](https://www.ians.com/blog/ians-research/build-metrics-that-resonate-with-multiple-audiences) [IANS Faculty Cyber Awareness Month Tips: Reduce Password Compromise Risk An IANS Faculty member explains how reusing passwords and usernames exposes work and personal accounts to attack. Oct 31, 20231 min read Olivia Rose Read more](https://www.ians.com/blog/ians-research/ians-faculty-cyber-awareness-month-tips-reduce-password-compromise-risk) [The New Biden AI Executive Order: Top Takeaways for Security Teams Biden AI executive order takeaways: safety tests for large AI systems, AI content watermarks, biological synthesis risk, and funding for privacy-preserving AI. Oct 30, 20232 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/the-new-biden-ai-executive-order-3-top-takeaways-for-security-teams)

[How to Improve Phishing Training for Employees An IANS Faculty member shares how to make phishing training more efficient and effective at improving awareness. Oct 26, 20235 min read Masha Sedova Read more](https://www.ians.com/blog/ians-research/make-phishing-training-more-efficient-to-improve-awareness) [Cyber Awareness Month With IANS Faculty: Tips for Better Password Management Password management tips for work and home: keep complex passwords in a password vault or manager, use MFA wherever you can, and remember one master password. Oct 24, 20231 min read Read more](https://www.ians.com/blog/ians-research/cyber-awareness-month-with-ians-faculty-tips-for-better-password-management) [IANS Faculty Cyber Awareness Month Tips: Improving Phishing Defenses An IANS Faculty member shares insight into the latest phishing attack methods and how to improve defenses through awareness. Oct 12, 20231 min read Read more](https://www.ians.com/blog/ians-research/ians-faculty-cyber-awareness-month-tips-improving-phishing-defenses)

[IANS Faculty Cyber Awareness Month Tips: How to Create Better Passwords Password compromise remains a leading cause of data breaches. A Cybersecurity Awareness Month video tip for better passwords: put spaces in your passwords. Oct 4, 20231 min read Read more](https://www.ians.com/blog/ians-research/ians-faculty-cyber-awareness-month-tips-how-to-create-better-passwords) [Why CISOs Need D&O Liability Insurance Coverage Now Why CISOs need directors and officers (D&O) liability insurance as SEC rules raise personal risk, how the coverage works, and how to win leadership buy-in. Sep 21, 20237 min read Alex Sharpe Read more](https://www.ians.com/blog/ians-research/why-cisos-need-d-o-liability-insurance-coverage-now) [Discover the Diversity of IANS Faculty Expertise How IANS Faculty practitioners bring hands-on expertise across generative AI, budgets and evolving SEC requirements. Sep 19, 20231 min read Masha Sedova Read more](https://www.ians.com/blog/ians-research/discover-the-diversity-of-ians-faculty-expertise)

[Public vs. Private API Security: Use a Three-Step Approach A three-step approach to securing both public and private APIs across your organization's environment. Sep 14, 20234 min read Gunnar Peterson Read more](https://www.ians.com/blog/ians-research/public-vs-private-api-security-use-a-three-step-approach) [Understand First- and Second-Gen SAST: Guidelines for the Best Choice Guidelines for choosing between first- and second-generation static application security testing tools. Sep 12, 20235 min read Read more](https://www.ians.com/blog/ians-research/understand-first-and-second-gen-sast-guidelines-for-the-best-choice) [Guidance to Create a PSIRT that Improves Incident Response Building a product security incident response team (PSIRT): an executive-backed charter, the right model, EU Cyber Resilience Act duties, and maturity phases. Sep 7, 20238 min read Read more](https://www.ians.com/blog/ians-research/guidance-to-create-a-psirt-that-improves-incident-response)

[Defining a Security Incident vs. Event: When to Report How to distinguish a security incident from an event and determine when it warrants formal reporting. Sep 5, 20232 min read Bill Dean Read more](https://www.ians.com/blog/ians-research/defining-a-security-incident-vs-event-when-to-report) [Guidance to Improve Patching and Vulnerability Management Patch SLAs invite pinning: a 30-day window means patching on Day 28. Patch for exploitability, not severity, with automated testing, rollback, and segmentation. Aug 31, 20235 min read Josh More Read more](https://www.ians.com/blog/ians-research/guidance-to-improve-patching-and-vulnerability-management) [CISO Traits Essential for SEC Board Readiness Why the board's role in cyber oversight and CISO expertise on public boards matters under the SEC's new cyber rules. Aug 29, 20231 min read Read more](https://www.ians.com/blog/ians-research/ciso-traits-essential-for-sec-board-readiness)

[Black Hat 2023: Key Takeaways and InfoSec Trends IANS Faculty share their key takeaways and infosec trends from the 2023 Black Hat Conference in Las Vegas. Aug 24, 20235 min read Read more](https://www.ians.com/blog/ians-research/black-hat-2023-key-takeaways-and-infosec-trends) [Gain Privacy Program Buy-In: Use Best-Selling Leadership Points How adopting a cybersecurity and privacy framework together helps ease the process of gaining leadership buy-in. Aug 21, 20234 min read Kelli Tarala Read more](https://www.ians.com/blog/ians-research/gain-privacy-program-buy-in-use-best-selling-leadership-points) [Error Handling and Logging Checklist An error handling and logging checklist for web apps, APIs, and other software: safe error handling, what and when to log, and what each log entry should hold. Aug 17, 20232 min read Read more](https://www.ians.com/blog/ians-research/error-handling-and-logging-checklist)

[How to Develop a More Holistic Risk Management Program How adding a quantitative, cradle-to-grave approach to risk management improves visibility into asset value at risk. Aug 15, 20236 min read Richard Seiersen Read more](https://www.ians.com/blog/ians-research/how-to-develop-a-more-holistic-risk-management-program) [IANS Summer Reading List: Cool Faculty Cyber Books to Check Out Five security books by IANS Faculty on Wi-Fi and IoT network design, Star Wars lessons for engineers, zero trust, IT leadership, and application security. Aug 7, 20232 min read Read more](https://www.ians.com/blog/ians-research/ians-summer-reading-list-cool-faculty-cyber-books-to-check-out) [Join IANS Faculty at Security Summer Camp in Las Vegas IANS Faculty events at Security Summer Camp, August 7 to 10 at Mandalay Bay, Las Vegas: a CISO comp cabana, a faculty dinner, a fireside chat, and a breakfast. Aug 3, 20232 min read Read more](https://www.ians.com/blog/ians-research/join-ians-faculty-at-security-summer-camp-in-las-vegas-aug-7-10)

[Reporting Meaningful Security Metrics to Leadership and the Board Cybersecurity metrics for the board: pair deployment metrics with risk-based KPIs, score SLAs as hit-and-miss ratios, and roll them up by NIST CSF function. Aug 1, 20238 min read Richard Seiersen Read more](https://www.ians.com/blog/ians-research/reporting-meaningful-security-metrics-to-leadership-and-the-board) [New SEC Cyber Rules: What to Do Next A high-level summary of the SEC's newly adopted cyber rules for public companies and advice on next steps for CISOs. Jul 28, 20233 min read Read more](https://www.ians.com/blog/ians-research/new-sec-cyber-rules-what-to-do-next) [Passwordless Authentication in Enterprises: Metrics and Milestones for a Seamless Deployment How to set appropriate goals and measure progress when deploying passwordless authentication at a large organization. Jul 27, 20233 min read Nick Hunt Read more](https://www.ians.com/blog/ians-research/passwordless-authentication-in-enterprises-metrics-and-milestones-for-a-seamless-deployment)

[Resonating With Leadership: Creating Security Metrics for Budgeting and Decision-Making How cyber-risk quantification helps create security metrics that resonate with the board on budgeting decisions. Jul 25, 20237 min read Richard Seiersen Read more](https://www.ians.com/blog/ians-research/resonating-with-leadership-creating-security-metrics-for-budgeting-and-decision-making) [Leveraging SEC's Cyber Rules for Public and Private Business Success How both public and private companies can use the SEC's cyber disclosure rules to drive business success. Jul 20, 20238 min read Bob Chaput Read more](https://www.ians.com/blog/ians-research/leveraging-secs-cyber-rules-for-public-and-private-business-success) [Guidance for CISOs Pursuing Board Positions Only 14% of R1000 CISOs hold four or more of five board traits. How CISOs can gauge board readiness, fill experience and skill gaps, and build a personal brand. Jul 18, 20234 min read Read more](https://www.ians.com/blog/ians-research/guidance-for-cisos-pursuing-board-positions)

[How to Select the Right DAST and SAST Tools An IANS Faculty member shares firsthand, practitioner-based insights on choosing the right DAST and SAST tools. Jul 13, 20235 min read Read more](https://www.ians.com/blog/ians-research/how-to-select-the-right-dast-and-sast-tools) [A Strategic Guide to Maturing Your Risk Management Function How to focus a growing risk management function on the value at risk and the controls with the highest return. Jul 11, 20236 min read Richard Seiersen Read more](https://www.ians.com/blog/ians-research/a-strategic-guide-to-maturing-your-risk-management-function) [Understand Code Integrity Risks for LLM-Produced Content LLM code engines like ChatGPT and Copilot carry serious IP and confidentiality risks. Build policies and controls before developers use them. Jul 6, 20234 min read Aaron Turner Read more](https://www.ians.com/blog/understand-code-integrity-risks-for-llm-produced-content)

[Guidance to Mature Your Threat Modeling Program How to grow a threat modeling program from ad hoc models to reproducible, resource-backed assessments. Jul 4, 20235 min read Read more](https://www.ians.com/blog/ians-research/guidance-to-mature-your-threat-modeling-program) [Actionable DevSecOps Best Practices Checklist A checklist of best practices to help a DevSecOps program succeed and avoid common pitfalls along the way. Jun 29, 20234 min read Read more](https://www.ians.com/blog/ians-research/devsecops-best-practices-checklist) [8 Ways to Mitigate ChatGPT and Generative AI Risks Generative AI tools like ChatGPT can leak sensitive data, raise ownership questions, hallucinate, and reflect bias. Here are eight ways to manage those risks. Jun 27, 20236 min read Jake Williams Read more](https://www.ians.com/blog/8-ways-to-mitigate-chatgpt-and-generative-ai-risks)

[Expanding the Scope: What's New for the Annual InfoSec Benchmark Survey The 2023 CISO compensation and budget benchmark survey, now in its fourth edition, expects 700+ respondents (175 in year one) and adds staff and BISO surveys. Jun 22, 20234 min read Read more](https://www.ians.com/blog/ians-research/expanding-the-scope-whats-new-for-the-annual-infosec-benchmark-survey) [How to Solve DAST and SAST Tool Challenges An IANS Faculty member shares tips for tackling common DAST and SAST tool challenges and promoting tool adoption. Jun 15, 20235 min read Read more](https://www.ians.com/blog/ians-research/how-to-solve-dast-and-sast-tool-challenges) [How to Build a 5-Step Ransomware Incident Response Plan A five-step ransomware incident response plan: prepare backups and insurance, detect anomalous file I/O, gather facts, choose a course of action, and restore. Jun 13, 20238 min read Kenneth van Wyk Read more](https://www.ians.com/blog/ians-research/how-to-build-a-5-step-ir-process-for-ransomware)

[Secure Both IT and OT Environments Effectively Best practices for managing the primary technology and staffing challenges of securing IT and OT together. Jun 8, 20236 min read Bryson Bort Read more](https://www.ians.com/blog/ians-research/secure-both-it-and-ot-environments-effectively) [How to Prevent Smishing Attacks Effectively How to prevent smishing: get HR, legal, and compliance buy-in; train everyone, executives included; set up reporting, including 7726; and automate simulations. Jun 6, 20234 min read Summer Craze Fowler Read more](https://www.ians.com/blog/ians-research/best-practices-for-building-a-smishing-program) [Tips to Mitigate AI Business Risks AI business risks: ChatGPT-written phishing, poisoned models, and black-box answers. Mitigate them with the NIST AI RMF, input checks, and error reporting. Jun 1, 20234 min read Joshua Marpet Read more](https://www.ians.com/blog/ians-research/tips-to-mitigate-ai-business-risks)

[Guidance to Simplify the Vendor Assessment Process Long, 200-question vendor questionnaires add cost, not security. Profile every vendor by context, then assess only high-risk contexts, perhaps 5% of vendors. May 30, 20235 min read Josh More Read more](https://www.ians.com/blog/ians-research/guidance-to-simplify-the-vendor-assessment-process) [Tips for Secure SaaS Third-Party Apps How to secure SaaS apps: approve one app per use case, license tiers with security features, set which data each app may hold, and train with simple rules. May 25, 20233 min read Josh More Read more](https://www.ians.com/blog/ians-research/tips-for-secure-saas-third-party-apps) [Exploring the Business Risks and Challenges of ChatGPT The legal and financial risks organizations face when adopting ChatGPT and similar generative AI tools. May 23, 20234 min read Read more](https://www.ians.com/blog/ians-research/exploring-the-business-risks-and-challenges-of-chatgpt)

[RSAC 2023: Key Takeaways and InfoSec Trends RSAC 2023 takeaways: the Stronger Together theme, ChatGPT and generative AI risk, staffing, supply chain security, and macOS attacks after the 3CX incident. May 18, 20234 min read Read more](https://www.ians.com/blog/ians-research/rsac-2023-key-takeaways-and-infosec-trends) [Choosing the Right Web Application Vulnerability Scanner The features to look for when defining requirements and narrowing down web application vulnerability scanner options. May 16, 20234 min read Kevin Beaver Read more](https://www.ians.com/blog/ians-research/how-to-choose-the-right-web-app-vulnerability-scanner) [ChatGPT: Misuse Scenarios & Security Risks of AI ChatGPT misuse: profiling targets for phishing, smishing, and vishing; malware by unskilled attackers; new vulnerability classes; and safe prototyping rules. May 11, 20235 min read Josh More Read more](https://www.ians.com/blog/ians-research/chatgpt-uncovering-misuse-scenarios-and-ai-security-challenges)

[Streamline Security Vendor Selection With VAC How the IANS Vendor Assessment Community offers independent resources to support every stage of vendor selection. May 9, 20232 min read Read more](https://www.ians.com/blog/ians-research/streamline-security-vendor-selection-with-vac) [Be Response Ready With IANS Tech Briefings How IANS Faculty Tech Briefings help security teams gain real-world context and guidance on breaking threats. May 4, 20232 min read Read more](https://www.ians.com/blog/ians-research/be-response-ready-with-ians-tech-briefings) [Detect Identity-Based Threats Using Your SIEM Detect identity-based threats with your SIEM: normalize IAM logs, then alert on impossible travel, MFA factor changes, token replay, and privilege changes. May 2, 20235 min read Nick Hunt Read more](https://www.ians.com/blog/ians-research/detect-identity-based-threats-using-your-siem)

[A Guide to Automated Pen Testing Tools How automated penetration testing tools fit between vulnerability scanners and manual pen tests to add ongoing value. Apr 27, 20234 min read Bill Dean Read more](https://www.ians.com/blog/ians-research/how-to-get-the-most-out-of-automated-pen-testing-tools) [Microsoft E3 vs. E5 License Comparison How new M365 security features affect third-party tooling decisions when weighing a move from E3 to E5 licenses. Apr 25, 20234 min read Aaron Turner Read more](https://www.ians.com/blog/ians-research/microsoft-e3-vs-e5-license-comparison) [Roadmap for Moving to ZTA (Zero Trust Architecture) and SASE A zero trust architecture (ZTA) and SASE roadmap: gather use cases, map to NIST SP 800-207 and CIS Controls v8, set the policy model, and mature it over time. Apr 20, 20237 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/ians-research/roadmap-for-moving-to-zta-zero-trust-architecture-and-sase)

[VDI vs. VPN vs. DaaS: Understanding the Differences VDI vs. VPN vs. DaaS: pros and cons of each, VDI security settings such as MFA and session timeouts, and when to choose VPN, VDI, or cloud remote access. Apr 18, 20236 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/remote-access-security-vpn-vs-vdi) [A Guide to Vendor Monitoring for Risk Mitigation Vendor monitoring after Log4j: risk-rank vendors by criticality, risk impact, data sensitivity, and network access; ask simple questions; and use GRC tools. Apr 13, 20235 min read Jeff Brown Read more](https://www.ians.com/blog/ians-research/vendor-monitoring-tips-to-help-mitigate-business-risk) [CISO Compensation Negotiation Checklist A checklist combining CISO experience and recruiter insights to help security leaders negotiate an optimal compensation package. Apr 11, 20232 min read Read more](https://www.ians.com/blog/ians-research/ciso-compensation-negotiation-checklist)

[How to Prepare for SEC's Cyber Disclosure Rules How the SEC's proposed cybersecurity disclosure rules will reshape incident response, board involvement and vendor oversight. Apr 6, 20234 min read Read more](https://www.ians.com/blog/ians-research/how-to-prepare-for-sec-s-cyber-disclosure-rules) [Making Cybersecurity Metrics Matter to the Business IANS Faculty member Summer Fowler on why cybersecurity metrics fall flat and how to tie them to business outcomes leaders actually understand. Apr 4, 20235 min read Summer Fowler Read more](https://www.ians.com/blog/making-cybersecurity-metrics-matter-to-the-business) [Zero Trust Network Segmentation Best Practices Zero trust segmentation means microsegmentation or ZTNA; few tools do both. Plan microsegmentation in phases, then weigh agents, coverage, and policy control. Mar 30, 20235 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/zero-trust-network-segmentation-best-practices)

[Guidance for Choosing the Right DAST Tool DAST tools for web apps and APIs should offer REST API or CLI automation, scan config files, OpenAPI and WSDL import, JSON or SARIF output, and quick scans. Mar 28, 20233 min read Eric Johnson Read more](https://www.ians.com/blog/ians-research/guidance-for-choosing-the-right-dast-tool) [Centralize Security within a Decentralized Organization Centralized vs. decentralized security: how a service-oriented model lets a central team support autonomous business units while keeping visibility and control. Mar 23, 20234 min read Ian Amit Read more](https://www.ians.com/blog/ians-research/centralize-security-within-a-decentralized-organization) [Microsegmentation Best Practices to Mitigate Malware Why enclave-based microsegmentation deployments based on asset value and risk work better than a strict 1-to-1 policy model. Mar 21, 20235 min read Read more](https://www.ians.com/blog/ians-research/microsegmentation-best-practices-to-mitigate-malware)

[Guidance for Improving the Security Architecture/Engineering Relationship How security architects can build cloud and IAM skills and adopt a consulting model to strengthen ties with engineering teams. Mar 16, 20235 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/guidance-for-improving-the-security-architecture-engineering-relationship) [Guidelines for the BISO Role An overview of the responsibilities BISOs take on to connect the central security agenda with divisional business units. Mar 14, 20234 min read Read more](https://www.ians.com/blog/ians-research/guidelines-for-the-biso-role) [Tips for Communicating Security Policy Changes How to communicate new and updated security policies to staff: a communication plan, clear language, multiple channels, and messages tailored to each audience. Mar 9, 20235 min read Jeff Brown Read more](https://www.ians.com/blog/ians-research/tips-for-communicating-security-policy-changes)

[Industrial Control System (ICS) Risk Mitigation Checklist ICS risk management checklist by maturity: asset inventory and tabletops (beginner), change control and logging (intermediate), and supply chain tests (expert). Mar 7, 20234 min read Bryson Bort Read more](https://www.ians.com/blog/ians-research/industrial-control-system-ics-risk-mitigation-checklist) [Trends in Executive Development and Certifications for CISOs Executive development data from 581 CISOs: 36% joined certified leadership programs, a third use executive coaching, and about half rate career development low. Mar 2, 20232 min read Read more](https://www.ians.com/blog/ians-research/trends-in-executive-development-certifications-for-cisos) [Soft Skills for Cybersecurity Productivity IANS Faculty member Jennifer (JJ) Minella on how developing soft skills helps security professionals become more productive and effective. Feb 28, 20234 min read JJ Jabbusch Read more](https://www.ians.com/blog/how-soft-skills-increase-security-productivity)

[Best Practices for Multi-Cloud Environment Management Multi-cloud security best practices: close talent and tooling gaps, pair CSP-native and third-party tools, check IAM coverage, and apply NIST or ISO/IEC 27001. Feb 23, 20232 min read George Gerchow Read more](https://www.ians.com/blog/ians-research/best-practices-to-manage-multi-cloud-environments) [Benchmark Report Preview: The BISO Role in Numbers BISO salary data: cash pay averages $320,000, total comp ranges from $160,000 to $600,000 and rose 14%, and nearly nine in 10 BISOs are open to a job change. Feb 21, 20233 min read Read more](https://www.ians.com/blog/ians-research/benchmark-report-preview-the-biso-role-in-numbers) [Benchmark Insights: Guide to Hiring and Retaining Security Leadership Key strategies for hiring and retaining CISOs and security leaders, drawn from the annual CISO Compensation and Budget Survey. Feb 16, 20232 min read Read more](https://www.ians.com/blog/ians-research/benchmark-insights-guide-to-hiring-and-retaining-security-leadership)

[MFA Implementation Checklist MFA rollout plan: document requirements, pick a solution, inventory authentication systems, prioritize privileged access, and lock down enrollment and recovery. Feb 14, 20235 min read Read more](https://www.ians.com/blog/ians-research/mfa-implementation-checklist) [Microsoft Entra ID (Azure AD) Identity Configuration Checklist An Azure AD (now Microsoft Entra ID) configuration checklist with recommended settings for privileged users and all tenant users to prevent identity incidents. Feb 9, 20237 min read Aaron Turner Read more](https://www.ians.com/blog/ians-research/azure-ad-identity-configuration-checklist) [Key Considerations Before Hiring a Deputy CISO What a deputy CISO (DCISO) does: streamlines security operations, speeds reporting, and backs up CISO succession, plus tips for defining and paying the role. Feb 7, 20233 min read Read more](https://www.ians.com/blog/ians-research/key-considerations-before-hiring-a-dciso)

[Tips for Vetting Vendors' Usage of Cloud Services Tips for evaluating how third-party vendors use cloud services as part of the vendor risk assessment process. Feb 2, 20235 min read Josh More Read more](https://www.ians.com/blog/ians-research/tips-for-vetting-vendors-usage-of-cloud-services) [Tips for Effective Negotiations With Leadership Win-win security negotiations with business leaders: pitch strategies over policies, think business first, frame security as an advantage, and solve problems. Jan 31, 20234 min read Ian Amit Read more](https://www.ians.com/blog/ians-research/tips-for-effective-negotiations-with-leadership) [Solutions to Common Passwordless Challenges Practical solutions to the most common challenges organizations face when adopting passwordless authentication. Jan 26, 20235 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/ians-research/solutions-to-common-passwordless-challenges)

[How to Make Passwordless Work in the Real World Common passwordless platform challenges and why most solutions only solve for one use case at a time. Jan 24, 20233 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/ians-research/how-to-make-passwordless-work-in-the-real-world) [How to Shift the Security/DevOps Paradigm IANS Faculty member Ian Amit on shifting from signature-based detection to tailored remediation to improve cloud infrastructure security. Jan 19, 20236 min read Ian Amit Read more](https://www.ians.com/blog/how-to-shift-the-security-devops-paradigm) [Benchmark Report Preview: CISO Job Satisfaction Survey findings on CISO job satisfaction and its key underlying drivers from the State of the CISO Report. Jan 17, 20233 min read Read more](https://www.ians.com/blog/ians-research/benchmark-report-preview-ciso-job-satisfaction)

[Cyber Incident Communications Checklist Cyber incident communication checklist for the first 72 hours: activate the crisis team, call advisors, plan stakeholder notices, and draft a holding statement. Jan 12, 20233 min read Bill Dean Read more](https://www.ians.com/blog/ians-research/cyber-incident-communications-checklist) [Understanding Microsoft Defender for Endpoint Settings Checklist A checklist for enabling and tuning Microsoft Defender for Endpoint baseline settings on Windows workstations and servers, plus recommended additions. Jan 12, 20236 min read Dave Shackleford Read more](https://www.ians.com/blog/microsoft-defender-for-endpoint-settings-checklist) [Risk Management Roles and Responsibilities Checklist A risk management roles and responsibilities checklist for building a dedicated risk team, covering risk establishment, monitoring, treatment, and metrics. Jan 10, 20234 min read Justin Leapline Read more](https://www.ians.com/blog/ians-research/risk-management-roles-and-responsibilities-checklist)

[Creating a Threat Model in 4 Efficient Steps Threat modeling steps: pick sources like the Verizon DBIR, check release timing, weigh pros and cons, and analyze trends to rank your top three to six threats. Jan 5, 20233 min read Read more](https://www.ians.com/blog/ians-research/4-steps-to-build-a-custom-threat-model) [Threat Model Business Alignment Checklist Threat model business alignment: interview leaders with open-ended questions, rank threats by dollar loss and likelihood, and finalize with an advisory group. Jan 3, 20235 min read Read more](https://www.ians.com/blog/ians-research/threat-model-business-alignment-checklist) [Best Practices for Deploying Passwordless Authentication How to navigate device and platform compatibility challenges when deploying passwordless authentication. Dec 27, 20226 min read Idan Shoham Read more](https://www.ians.com/blog/ians-research/best-practices-for-deploying-passwordless-authentication)

[Tips for Passwordless Adoption Passwordless authentication best practices: use MFA, offer two or more credential combinations, plan for lost devices, and migrate users in small groups. Dec 22, 20224 min read Read more](https://www.ians.com/blog/ians-research/tips-for-passwordless-adoption) [Benchmark Report Preview: InfoSec Org Design A preview of benchmark findings on how security organizational design shifts at different revenue milestones. Dec 20, 20223 min read Read more](https://www.ians.com/blog/ians-research/benchmark-report-preview-infosec-org-design) [Benchmark Report Preview: Salaries for Top Infosec Leaders Pay data from 520+ CISOs on seven leader roles below the CISO: total comp averages $301,000, deputy CISOs lead at $382,000, and the top 25% average $540,000. Dec 13, 20223 min read Read more](https://www.ians.com/blog/ians-research/benchmark-report-preview-salaries-for-top-infosec-leaders)

[OT Security Best Practices Checklist OT security best practices based on the Purdue model: IT/OT segmentation with air gaps, firewalls, or data diodes, network modeling, and OT asset inventory. Dec 8, 20227 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/ot-security-best-practices-checklist) [Steps to Improve Cyber Attack Surface Management Guidance for aligning IT, SecOps and DevOps teams to better identify risk across a growing attack surface. Dec 6, 20224 min read Read more](https://www.ians.com/blog/ians-research/9-steps-to-improve-attack-surface-management) [Vendor Risk Management Best Practices Key focus areas for optimizing a vendor management program, how to measure maturity and pitfalls to avoid. Dec 1, 20229 min read Josh More Read more](https://www.ians.com/blog/ians-research/6-ways-to-optimize-vendor-management-programs)

[7 Steps to Align IT, OT and Physical Security Seven steps to align IT, OT, and physical security: staff exchanges, a shared glossary, combined-modality threat models, joint tabletops, and merged policies. Nov 29, 20226 min read Chris Poulin Read more](https://www.ians.com/blog/ians-research/7-steps-to-align-it-ot-and-physical-security) [Understand the Changes to NIST's Supply Chain Security Guidance How updated NIST guidance changes risk appetite and tolerance expectations for supply chain security. Nov 23, 20225 min read Earl Crane Read more](https://www.ians.com/blog/ians-research/understand-the-changes-to-nists-supply-chain-security-guidance) [Checklist for Detecting Ransomware Precursors A checklist to help organizations proactively detect ransomware precursors before encryption ever begins. Nov 21, 20222 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/checklist-for-detecting-ransomware-precursors)

[The Most Common Ransomware Attacks and How to Prepare for Them Why ransomware planning should prioritize business services and their relative importance, not just impacted systems. Nov 17, 20226 min read Bill Dean Read more](https://www.ians.com/blog/ians-research/how-to-prepare-for-common-ransomware-scenarios) [What Is a Virtual CISO? Benefits and Considerations Why a virtual CISO can be a viable option for smaller and mid-market organizations struggling to attract top security talent. Nov 15, 20223 min read Read more](https://www.ians.com/blog/ians-research/benefits-of-a-virtual-ciso) [Penetration Test Preparation Checklist Pen test plan checklist: compliance goals like PCI or HIPAA, network IP ranges, web and mobile app access, emergency contacts, and rules of engagement. Nov 10, 20223 min read Read more](https://www.ians.com/blog/ians-research/penetration-test-preparation-checklist)

[Create a Security Charter Committee to Align with the Business How a security charter committee helps align security priorities and investment with business goals. Nov 8, 20226 min read Nicole Dove Read more](https://www.ians.com/blog/ians-research/create-a-security-charter-committee-to-align-with-the-business) [How to Communicate Ransomware Risk in Business Terms Best practice strategies for translating ransomware risk into terms nontechnical business leaders understand. Nov 3, 20225 min read Josh More Read more](https://www.ians.com/blog/ians-research/how-to-communicate-ransomware-risk-in-business-terms) [2022 Security Budget Benchmark Report Preview 2022 security budget data from 500+ CISOs: 79% saw budgets rise, breaches and incidents drove the largest increases (36%), and staff and compensation took 39%. Nov 1, 20222 min read Read more](https://www.ians.com/blog/ians-research/2022-security-budget-benchmark-report-preview)

[How to Navigate Attack Surface Management Challenges Why nearly half of organizations have been breached through a previously unknown asset, and how to close that gap. Oct 27, 20224 min read Read more](https://www.ians.com/blog/ians-research/how-to-navigate-attack-surface-management-challenges) [Tips for Building a Cybersecurity Service Catalog Best practices, pitfalls to avoid, and content and template examples for building a cybersecurity service catalog aligned to the business. Oct 25, 20227 min read Mike Saurbaugh Read more](https://www.ians.com/blog/ians-research/tips-for-building-a-cybersecurity-service-catalog) [How to Build an Attack Surface Management Program Attack surface management program steps: map internal and external assets, pen test for weak points, boost visibility, automate with ASM tools, and train staff. Oct 20, 20225 min read Read more](https://www.ians.com/blog/ians-research/how-to-build-an-attack-surface-management-program)

[2022 CISO Compensation Benchmark Report Preview Two key data points from the 2022 CISO Compensation Benchmark Report, including job-change sentiment among CISOs. Oct 18, 20221 min read Read more](https://www.ians.com/blog/ians-research/2022-ciso-compensation-benchmark-report-preview) [M365 Hardening: Protecting Against Sophisticated Attacks M365 hardening for Exchange Online and Azure AD: check Safe Links for drift, require MFA on all logins, and use Defender for Identity or Identity Protection. Oct 13, 20226 min read Aaron Turner Read more](https://www.ians.com/blog/ians-research/m365-hardening-protecting-against-sophisticated-attacks) [NIST Cybersecurity Framework: Guidance on Implementation and Adoption The benefits of the NIST Cybersecurity Framework and best practices for implementing its five pillars. Oct 11, 20224 min read Read more](https://www.ians.com/blog/ians-research/nist-cybersecurity-framework-guidance-on-implementation-adoption)

[How to Build an Enterprise Privacy Program How to meet the challenge of enterprise privacy programs by establishing a risk-based approach aligned with the business. Oct 6, 20226 min read Chris Hetner Read more](https://www.ians.com/blog/ians-research/how-to-build-an-enterprise-privacy-program) [A Guide to NIST Standards and Frameworks A list of key NIST standards and frameworks, from privacy to supply chains. NIST is not a regulator, but federal agencies must use its Cybersecurity Framework. Oct 4, 20225 min read Read more](https://www.ians.com/blog/ians-research/a-guide-to-nist-standards-and-frameworks) [How to Integrate Security and Enterprise Architecture How security architecture and enterprise architecture can align to support secure business initiatives. Sep 29, 20225 min read Anand Singh Read more](https://www.ians.com/blog/ians-research/how-to-integrate-security-and-enterprise-architecture)

[How to Maximize Cyber Insurance Claims How rising premiums and demand for cyber coverage make it critical to understand how to maximize a claim. Sep 27, 20227 min read Read more](https://www.ians.com/blog/ians-research/how-to-maximize-cyber-insurance-claims) [Cyber Insurance Coverage Best Practices Learn how first-party and third-party cyber insurance differ and what policies pay for after a breach. Then use six checks to choose an insurer and a policy. Sep 22, 20226 min read Read more](https://www.ians.com/blog/ians-research/cyber-insurance-coverage-best-practices) [How to Align Data Deletion Policies with Privacy Compliance How to manage data deletion and sanitization requirements as new regulations demand deletion at a user's request. Sep 20, 20225 min read Jeff Brown Read more](https://www.ians.com/blog/ians-research/how-to-align-data-deletion-policies-with-privacy-compliance)

[Audits, Assessments and Testing: Understand the Differences The key definitions behind audits, assessments and testing, and how to use each term correctly across compliance scenarios. Sep 15, 20226 min read Rich Guida Read more](https://www.ians.com/blog/ians-research/audits-assessments-and-testing-understand-the-differences) [How to Develop Career Paths for Your Security Team How to build career pathways for security employees that account for their individual skills and motivations. Sep 8, 20227 min read Mike Saurbaugh Read more](https://www.ians.com/blog/ians-research/how-to-develop-career-paths-for-your-security-team) [Understand Variations of the CISO Role How the CISO role varies, what BISO, TISO, deputy CISO (DCISO), and virtual CISO (vCISO) roles do, and how to tailor security leadership to your organization. Sep 6, 20227 min read Read more](https://www.ians.com/blog/ians-research/understand-variations-of-the-ciso-role)

[How to Align Security With ESG Compliance Security shapes the social and governance factors of ESG scores. Align by treating cyber as risk, disclosing fast, hiring security leaders, and vetting vendors. Sep 1, 20225 min read Read more](https://www.ians.com/blog/ians-research/how-to-align-security-with-esg-compliance) [Making the Transition From SOC 1 to SOC 2 Reporting Moving from SOC 1 to SOC 2 reporting: who needs SOC 2, the Trust Services Criteria, audit time and buy-in challenges, and choosing SOC 2 Type 1 or Type 2. Aug 30, 20223 min read Read more](https://www.ians.com/blog/ians-research/making-the-transition-from-soc-1-to-soc-2-reporting) [Mature Your Security Program With SOC 2 Reporting How SOC 2 reporting has become a widely used way to evaluate organizational security and compliance controls. Aug 25, 20223 min read Read more](https://www.ians.com/blog/ians-research/mature-your-security-program-with-soc-2-reporting)

[Steps to Customize a Risk Framework How to start with a foundational risk framework and customize it to fit an organization's maturity, culture and priorities. Aug 23, 20224 min read Nicole Dove Read more](https://www.ians.com/blog/ians-research/4-steps-to-customize-a-risk-framework) [5 Key Benefits of Implementing Zero Trust Zero trust reduces attack surface, limits lateral movement and strengthens visibility across the enterprise. Aug 18, 20224 min read Read more](https://www.ians.com/blog/ians-research/5-key-benefits-of-implementing-zero-trust) [How to Establish a Data and Systems Classification Strategy How to identify critical systems and prioritize data protection using criticality criteria across confidentiality, integrity and availability. Aug 16, 20224 min read Chris Hetner Read more](https://www.ians.com/blog/how-to-establish-a-data-and-systems-classification-strategy)

[Build Executive Buy-In for Zero Trust Why zero trust has become a critical requirement and how to build executive support for adopting it. Aug 16, 20223 min read Read more](https://www.ians.com/blog/ians-research/build-executive-buy-in-for-zero-trust) [How to Prevent and Detect Packet Sniffing Attacks How packet sniffing attacks work, active vs. passive sniffing, common techniques, and how to prevent them with network hardening, encryption, and VPN or ZTNA. Aug 11, 202211 min read Read more](https://www.ians.com/blog/ians-research/how-to-prevent-and-detect-packet-sniffing-attacks) [How to Drive SSO Adoption at Your Organization How security teams can position single sign-on to end users while transitioning to more sophisticated authentication strategies. Aug 9, 20224 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/ians-research/how-to-drive-sso-adoption-at-your-organization)

[Why SOC Audits Are Key Drivers of Business Competitiveness How SOC audits help organizations demonstrate trust and gain a competitive edge with customers and partners. Aug 4, 20225 min read Read more](https://www.ians.com/blog/ians-research/why-soc-audits-are-key-drivers-of-business-competitiveness) [Keys to Hiring and Retaining Top Cybersecurity Talent How security leaders can navigate a volatile post-pandemic labor market to hire and retain top security talent. Aug 2, 20225 min read Nicole Dove Read more](https://www.ians.com/blog/ians-research/3-keys-to-retaining-cybersecurity-talent) [Cyber Insurance Renewal Checklist Cyber insurance renewal checklist: build resilience year-round, get a third-party audit, call your broker 90+ days out, and beware clarification endorsements. Jul 28, 20223 min read Read more](https://www.ians.com/blog/ians-research/cyber-insurance-renewal-checklist)

[Best Practices to Detect & Prevent BEC Attacks BEC attack identifiers like fake invoices, routing number changes, and executive payment requests, plus defenses such as external verification and signed email. Jul 26, 20225 min read Dave Shackleford Read more](https://www.ians.com/blog/ians-research/best-practices-to-mitigate-and-detect-bec-attacks) [Detect and Prevent Clone Phishing Attacks An overview of clone phishing attacks and methods to detect and prevent this increasingly deceptive attack technique. Jul 21, 20228 min read Read more](https://www.ians.com/blog/ians-research/detect-and-prevent-clone-phishing-attacks) [How to Protect Your Team From Zero-Day Attacks and Mitigate Risks How to gain insight into the growing threat of zero-day attacks and reduce the risks they pose to your organization. Jul 19, 20225 min read Read more](https://www.ians.com/blog/ians-research/how-to-prevent-detect-and-mitigate-zero-day-attacks)

[Guidance to Detect and Prevent BEC Attacks How business email compromise attacks work and the guidance needed to detect and prevent this costly form of cybercrime. Jul 14, 20228 min read Read more](https://www.ians.com/blog/ians-research/guidance-to-detect-and-prevent-bec-attacks) [Addressing CISOs' Challenges and Expectations Guidance for CISOs facing growing threats and business expectations to improve executive alignment and strengthen their teams. Jul 12, 20226 min read Read more](https://www.ians.com/blog/ians-research/addressing-challenges-and-expectations-facing-cisos) [Keys to Addressing Systemic Vulnerabilities Why an asset inventory, scanning tooling and a solid incident response plan are essential to handle the next Log4j-scale event. Jul 7, 20226 min read Summer Craze Fowler Read more](https://www.ians.com/blog/ians-research/3-keys-to-addressing-systemic-vulnerabilities)

[How to Create a Temporary SOC 2 Alternative How organizations can bridge the gap with a temporary alternative while working toward full SOC 2 compliance. Jul 5, 20225 min read George Gerchow Read more](https://www.ians.com/blog/ians-research/how-to-create-a-temporary-soc-2-alternative) [What Are Zero-Click Attacks? Detection & Prevention What zero-click attacks are, how they differ from zero-day exploits, real examples, and how to reduce the risk with patching, segmentation, and Lockdown Mode. Jun 30, 20226 min read Read more](https://www.ians.com/blog/ians-research/how-to-prevent-and-detect-zero-click-attacks) [How to Create Meaningful Security Metrics and KPIs Security metrics and KPIs: CIS sigma levels, five effectiveness metrics (burndown, survival, arrival, inter-arrival, and escape rates), and 90-day baselines. Jun 28, 20228 min read Richard Seiersen Read more](https://www.ians.com/blog/ians-research/how-to-create-meaningful-security-metrics-and-kpis)

[Data Exfiltration: Insider Threat Indicators and Prevention Insider data exfiltration indicators, from unusual logins and privilege escalation to excessive downloads, plus prevention for remote and departing employees. Jun 23, 20227 min read Read more](https://www.ians.com/blog/ians-research/data-exfiltration-insider-threat-indicators-and-prevention) [How Security Budgets Break Down How security budgets break down: 2021 data from 500+ CISOs shows security at 10% of IT budgets, with 38% spent on staff, 28% on software, and 7% on hardware. Jun 21, 20226 min read Read more](https://www.ians.com/blog/ians-research/how-security-budgets-break-down) [Key Drivers of CISO Compensation CISO pay in 2021, from 500+ CISOs: $463,000 average total pay ($342,000 median), more than double at firms over $50B market cap, and 7% more for female CISOs. Jun 14, 20224 min read Read more](https://www.ians.com/blog/ians-research/key-drivers-of-ciso-compensation)

[Insider Data Exfiltration: Threats and New Challenges Insider data exfiltration explained: types of insider data theft, risks and vulnerabilities, new challenges for security teams, and best practices to stop it. Jun 9, 20224 min read Read more](https://www.ians.com/blog/ians-research/insider-data-exfiltration-threats-and-new-challenges) [Watering Hole Attacks: Threats and Best Practices Watering hole attacks infect sites their targets visit. The five stages, why they evade detection, and defenses like MFA, patching, traffic monitoring, and EDR. Jun 7, 20224 min read Read more](https://www.ians.com/blog/ians-research/watering-hole-attacks-understand-threats-and-best-practices) [Build a Strong GRC Maturity Roadmap to Align with the Business How to build a GRC maturity roadmap that aligns governance, risk and compliance work with business priorities. Jun 2, 20225 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/ians-research/build-a-strong-grc-maturity-roadmap-to-align-with-the-business)

[Six Common Social Engineering Attack Methods The most common social engineering attack methods security teams should train employees to recognize. May 26, 20223 min read Read more](https://www.ians.com/blog/ians-research/six-common-social-engineering-attack-methods) [Social Media Security Guidance for the C-Suite Protect executive Twitter, LinkedIn, and Facebook accounts from hijacking and whaling: unique 16+ character passwords, non-SMS 2FA, and limited contact info. May 19, 20224 min read Read more](https://www.ians.com/blog/ians-research/social-media-security-guidance-for-the-c-suite) [Key Features to Look for in a GRC Tool GRC tool features across ERM, compliance, and IT governance: risk models, KRIs, policy management, regulatory feeds, IT inventory, and control testing. May 10, 20223 min read Chris Hetner Read more](https://www.ians.com/blog/ians-research/key-features-to-look-for-in-a-grc-tool)

[How to Advance Your Phishing Program to Address Ransomware Why a phishing program needs policy, technology and training working together to address the growing ransomware threat. May 3, 20225 min read Summer Craze Fowler Read more](https://www.ians.com/blog/ians-research/how-to-advance-your-phishing-program-to-address-ransomware) [Guidance for Launching a Threat Hunting Program A threat hunting program needs a mature security program. Four maturity stages, from vulnerable to mature, show when you have the staff, tools, and baselines. Apr 28, 20224 min read Read more](https://www.ians.com/blog/ians-research/guidance-for-launching-a-threat-hunting-program) [What Is a Purple Team? Strategies for Effective Collaboration What is a purple team? Red and blue teams working as one unit. To build one, plan with MITRE ATT&CK, automate testing, set goals, execute, and measure results. Apr 26, 20224 min read Read more](https://www.ians.com/blog/ians-research/strategies-for-building-an-effective-purple-team)

[Data Exfiltration: Threats, Challenges and Prevention How to understand data exfiltration types and methods to keep critical organizational data secured and protected. Apr 21, 20224 min read Read more](https://www.ians.com/blog/ians-research/data-exfiltration-threats-challenges-and-prevention) [Understand the Roles of Red, Blue and Purple Teams Red team vs. blue team vs. purple team: red teams act as attackers, blue teams defend, and purple teams combine both to strengthen your security posture. Apr 19, 20224 min read Read more](https://www.ians.com/blog/ians-research/understand-the-roles-of-red-blue-and-purple-teams) [How to Build a Proactive Threat Hunting Strategy How an efficient, proactive threat hunting strategy lowers the risk of compromises and data breaches slipping past defenses. Apr 14, 20224 min read Read more](https://www.ians.com/blog/ians-research/how-to-build-a-proactive-threat-hunting-strategy)

[Create Security Metrics That Connect Back to the Business Practical security metrics that tie to business outcomes: enabling revenue, calculating security scale, and defining a defensible key risk indicator. Apr 12, 20226 min read Richard Seiersen Read more](https://www.ians.com/blog/create-security-metrics-that-connect-back-to-the-business) [How to Harness the Power of Purple Teaming How purple teaming's collaboration between red and blue teams improves on the limited visibility of a red-team-only exercise. Apr 12, 20228 min read Joff Thyer Read more](https://www.ians.com/blog/ians-research/how-to-harness-the-power-of-purple-teaming) [Purple Team Exercise Readiness Checklist Purple team exercise readiness: enforceable policies, asset inventory, hardened endpoints, routine vulnerability scans, regular pen tests, and a mature SOC. Apr 7, 20223 min read Read more](https://www.ians.com/blog/ians-research/purple-team-exercise-readiness-checklist)

[Threat Hunting 101: Understand the Basics Threat hunting 101: assume compromise, boot from trusted media to find unauthorized changes, check process memory, analyze logs and NetFlow, and start small. Apr 5, 20226 min read Kenneth van Wyk Read more](https://www.ians.com/blog/ians-research/threat-hunting-101-understand-the-basics) [Best Practices for Building Effective Purple Team Exercises Purple team exercise best practices: how red and blue teams collaborate, what purple teaming is for, and step-by-step guidance to build an effective exercise. Mar 31, 20224 min read Read more](https://www.ians.com/blog/ians-research/best-practices-for-building-effective-purple-team-exercises) [Software Supply Chain Threat Modeling Checklist A supply chain checklist for threat modeling third-party software, built on the Microsoft SDL: requirements, crypto, SAST, DAST, pen testing, vendor IR. Mar 30, 20228 min read Jake Williams Read more](https://www.ians.com/blog/software-supply-chain-threat-modeling-checklist)

[Building a Third-Party Risk Management Checklist Recommendations and best practices for building a checklist to plan for and prepare against third-party risk. Mar 29, 20224 min read Read more](https://www.ians.com/blog/ians-research/building-a-third-party-risk-management-checklist) [How to Build a Third-Party Risk Management Framework A third-party risk management framework built on NIST and ISO: setup and monitoring stages, five risk types, vendor visibility gaps, and eight build steps. Mar 24, 20224 min read Read more](https://www.ians.com/blog/ians-research/how-to-build-a-third-party-risk-management-framework) [Third-Party Risk Management: Guidance for InfoSec Teams Guidance for infosec teams on building and running an effective third-party risk management program. Mar 17, 20224 min read Read more](https://www.ians.com/blog/ians-research/guidance-for-managing-third-party-risk)

[How to Track Phishing Resilience Using a Metrics Matrix How to build a phishing metrics matrix that tracks trends over time instead of single-point campaign results. Mar 10, 20225 min read Ian Amit Read more](https://www.ians.com/blog/ians-research/how-to-track-phishing-resilience-using-a-metrics-matrix) [Ransomware: Prevention and Response Tactics Key preventive controls and response tactics for mitigating ransomware's impact across the organization. Mar 8, 20226 min read Anand Singh Read more](https://www.ians.com/blog/ians-research/ransomware-prevention-and-response-tactics) [Container Security Challenges and Best Practices The security risks containers introduce alongside their development benefits, and how to manage them. Mar 3, 20223 min read Read more](https://www.ians.com/blog/ians-research/challenges-of-container-security-and-how-to-do-it-right)

[Best Practices for Business Vishing Attack Prevention and Response How security teams can prevent and respond to increasingly sophisticated voice-based phishing attacks. Mar 1, 20224 min read Read more](https://www.ians.com/blog/ians-research/best-practices-for-business-vishing-attack-prevention-and-response) [Russian Invasion: How to Evaluate Your Organization's Cyber Risk A five-point test to help organizations evaluate cyber risk stemming from the Russian invasion of Ukraine. Feb 28, 20221 min read Jake Williams Read more](https://www.ians.com/blog/ians-research/russian-invasion-how-to-evaluate-your-organizations-cyber-risk) [Best Practices for Building a Strong API Security Program How to inventory APIs and apply application security tactics to build a strong API security program. Feb 24, 20224 min read Read more](https://www.ians.com/blog/ians-research/best-practices-for-building-a-strong-api-security-program)

[How to Conduct Vishing Test Exercises How to run vishing test exercises that build employee awareness: help desk tests, AI voice cloning risks, and do's and don'ts that protect the business. Feb 22, 20229 min read Read more](https://www.ians.com/blog/ians-research/how-to-conduct-vishing-test-exercises) [How Vishing Attacks Impact Your Business How increasingly sophisticated vishing techniques bypass prevention tactics and what security teams should understand. Feb 17, 20224 min read Read more](https://www.ians.com/blog/ians-research/how-vishing-attacks-impact-your-business) [Best Practices for Cybersecurity Asset Management Cybersecurity asset management success factors: visibility tools, multilevel asset data, critical data sources, and strong business unit relationships. Feb 15, 20226 min read Adrian Sanabria Read more](https://www.ians.com/blog/ians-research/best-practices-for-solid-cybersecurity-asset-management)

[Understand the Differences Between Spear-Phishing and Phishing The difference between phishing and spear phishing: vishing and smishing cast a wide net, while whaling, C-level attacks, and BEC target high-value employees. Feb 10, 20223 min read Read more](https://www.ians.com/blog/ians-research/understand-the-differences-between-spear-phishing-and-phishing) [6 Key Phases of an Effective Global Threat Response Playbook A six-phase framework for building a global threat response playbook, from deciding whether to act through coordinating response and oversight. Feb 9, 20227 min read Jake Williams Read more](https://www.ians.com/blog/6-key-phases-of-an-effective-global-threat-response-playbook) [Key Takeaways From the 2021 Cloud Security Maturity Model Report Key findings from the 2021 Cloud Security Maturity Benchmark Report on planning and implementation readiness. Feb 8, 20224 min read Read more](https://www.ians.com/blog/ians-research/key-takeaways-from-the-2021-cloud-security-maturity-model-report)

[Assess the Maturity Level of Your Cloud Security Program How the Cloud Security Maturity Model helps organizations manage the risks of increasingly complex cloud environments. Feb 3, 20223 min read Read more](https://www.ians.com/blog/ians-research/assess-the-maturity-level-of-your-cloud-security-program) [Build a Stronger Security Culture with a BISO What is a BISO? A liaison between business units and security. The role suits multi-unit firms and needs six skills, from communication to clear metrics. Feb 1, 20223 min read Read more](https://www.ians.com/blog/ians-research/build-a-stronger-security-culture-with-a-biso) [How to Make Tangible Progress with Zero Trust Zero trust as a repeatable architecture pattern: common use cases, strategy, tooling, threat mitigations, and the pitfalls that stall programs. Jan 31, 20226 min read Wolfgang Goerlich Read more](https://www.ians.com/blog/how-to-make-tangible-progress-with-zero-trust)

[How to Detect Ransomware with an SIEM Ransomware has become a critical problem for organizations trying to protect important data. Discover how to detect ransomware with an SIEM solution. Jan 28, 20223 min read Ondrej Krehel Read more](https://www.ians.com/blog/ians-research/how-to-use-your-siem-to-detect-ransomware-attacks) [Does Your Business Need a BISO? How the BISO role is evolving to give large, multi-business-unit organizations a more strategic security focus. Jan 25, 20222 min read Read more](https://www.ians.com/blog/ians-research/does-your-business-need-a-biso) [Data Governance 101: Establish a Solid Foundation Why treating data governance as an ongoing practice, not a one-time project, is the most critical element of a program. Jan 20, 20225 min read Josh More Read more](https://www.ians.com/blog/ians-research/data-governance-101-establish-a-solid-foundation)