Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In Part 1 of this blog series The Ransomware Threat: Preparing Schools and Libraries for Ransomware Attacks, we discussed creating a pre-incident plan that includes a backup process, asset management, identity and access management, risk-based vulnerability management, and security awareness training to minimize the risk of ransomware attacks.

Year after year, we continue to see increases in phishing and business email compromises (BEC), and the costs associated with these incidents are growing, too. The LevelBlue Security Operations Center (SOC) found that BEC attacks made up 70% of the total incidents investigated during the second half of 2024. Of these incidents, 96% of them involved one or more phished users.

As we continue to face an increasingly complex cybersecurity landscape, April 2025 has brought forward new vulnerabilities and the rise of more sophisticated cyber threats. Notable vulnerabilities in critical systems, including Microsoft, Adobe, Cisco, and others, underscore the importance of proactive security measures. Alongside these vulnerabilities, the persistence of ransomware groups continues to be a major concern for organizations globally.

As the attack surface expands and organizations face pressure from evolving regulatory requirements, it becomes increasingly difficult to align compliance management with overall risk strategy. As a result, many organizations are managing compliance and risk separately, leading to redundancies, inefficiencies, and critical gaps that are overlooked or improperly managed.

Since April 2025, version 4.0.1 of the PCI DSS standard has become the sole reference for all companies handling payment card data. Whether it involves processing, storing, or simply transmitting, the security of banking data has become a non-negotiable priority in a digital world that is more vulnerable than ever. The digital landscape of endless online payment transactions across various sectors.

It is no secret that AI is advancing at a blistering pace for everyone – including cyber adversaries. The mainstream unveiling of generative AI in 2024 brought about the biggest disruption in computing since the microprocessor. AI solutions promise the world unprecedented levels of efficiency, speed, and automation. However, this seemingly utopian and disruptive technology is evolving more quickly than governance and regulations can keep pace and implement guard rails for use and adoption.

In cybersecurity, speed has always been a big deal. How quickly can you detect an incident? How fast can you respond? But in the rush to act fast, many teams overlook what matters most. Are we actually solving the problem? Incident response is not just about being fast. It's about being effective. It's about making sure the threat is fully understood, resolved, and prevented from coming back.

Cyberattacks continue to evolve and increase in frequency, making it difficult for organizations to keep up. This can leave them vulnerable, especially when resources are constrained, and no clear processes exist to respond in a timely manner. Coupled with the SEC’s new regulations around risk disclosure and incident reporting, this lack of preparedness is a growing concern.

As stated in my recent blog, CISO: Chief Cybersecurity Warrior Leader, I define warrior-leadership as a term that combines the concepts of leadership and expertise in the field of cybersecurity with the mindset and traits of a warrior. A warrior mindset helps leaders remain calm, focused, and effective in addressing and resolving complex challenges.