Asset Management

Hand selecting a blue figure for a leadership role, symbolizing business recruitment, promotion, and management.

Bug Bounties

Nexus

Patch/Configuration Management

Penetration Testing

Risk Identification/Classification/Mitigation

Vulnerability Management

Tech Explainer

What Executive Exposure Risk Reporting Actually Requires

vulnerability_AdobeStock_909297607

Buyer's Guide

How to Evaluate Risk-Based Vulnerability Prioritization Platforms

Laptop computer displaying data breach warning, highlighting cyber security threats and vulnerabilities in modern technology

Laptop computer displaying data breach warning, highlighting cyb

How to Evaluate Vulnerability & Exposure Management Platforms

<body>With Q-day getting closer, regulatory guidance pushing firms to migrate to quantum security in the next five years, and an extensive remediation backlog waiting to be discovered, security leaders must start their quantum security migration today.  Easier said than done. In this Say Easy, Do Hard segment, we discuss the quantum-safe journey using a framework for crypto-agility.</body>

<body><p>With Q-day getting closer, regulatory guidance pushing firms to migrate to quantum security in the next five years, and an extensive remediation backlog waiting to be discovered, security leaders must start their quantum security migration today.  Easier said than done. In this Say Easy, Do Hard segment, we discuss the quantum-safe journey using a framework for crypto-agility.</p></body>

<body>In part 1, we define cryptographic agility, or crypto-agility for short, and why it's important. Crypto-agility is not just about transitioning to quantum-safe cryptography in the nimblest way possible, and it’s not something that can be achieved merely by updating encryption algorithms and protocols. Instead, you need to adapt your organization’s cryptographic architecture, automation, and governance to allow for greater control and flexibility.</body>

<body><p>In part 1, we define cryptographic agility, or crypto-agility for short, and why it's important. Crypto-agility is not just about transitioning to quantum-safe cryptography in the nimblest way possible, and it’s not something that can be achieved merely by updating encryption algorithms and protocols. Instead, you need to adapt your organization’s cryptographic architecture, automation, and governance to allow for greater control and flexibility.</p></body>

<body>In part 2, we discuss a framework for discovery, prioritization, and remediation while keeping crypto-agility in mind.  A quantum-safe journey requires:</body>

<body><p>In part 2, we discuss a framework for discovery, prioritization, and remediation while keeping crypto-agility in mind.  A quantum-safe journey requires:</p></body>

<body><ul><li>Inventory of Systems With Non-Quantum-Safe Algorithms And Protocols</li><li>System Prioritization, Leading To A Migration Roadmap</li><li>Remediation, Including Vendors And Partners</li></ul></body>

<body>Once a distant possibility, Q-Day is quickly approaching.  Are you ready for 2030?</body>

<body><p>Once a distant possibility, Q-Day is quickly approaching.  Are you ready for 2030?</p></body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://pqcc.org/wp-content/uploads/2025/05/PQC-Migration-Roadmap-PQCC-2.pdf">https://pqcc.org/wp-content/uploads/2025/05/PQC-Migration-Roadmap-PQCC-2.pdf</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://pqcc.org/wp-content/uploads/2025/06/PQCC-Inventory-Workbook.xlsx">https://pqcc.org/wp-content/uploads/2025/06/PQCC-Inventory-Workbook.xlsx</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://qramm.org/learn/cryptoscan-guide.html">https://qramm.org/learn/cryptoscan-guide.html</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://research.ibm.com/blog/quantum-safe-cbomkit">https://research.ibm.com/blog/quantum-safe-cbomkit</a></li></ul></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14445″} podcast from PPWorks

Industry Regulations

Encryption

Say Easy, Do Hard – Crypto-Agility – BSW #440

<body>Segment 1 - Interview with Tim Morris</body>

<body><h3>Segment 1 - Interview with Tim Morris</h3></body>

<body>Bringing intelligence to assets</body>

<body><p>Bringing intelligence to assets</p></body>

<body>You’ve been through 6 CMDB projects in the last decade. None of them came close to the original goals, the CMDB was already out-of-date long before the project had any hopes of completing. Is building an asset inventory just too ambitious a project for most organizations, or is there a better way?</body>

<body><p>You’ve been through 6 CMDB projects in the last decade. None of them came close to the original goals, the CMDB was already out-of-date long before the project had any hopes of completing. Is building an asset inventory just too ambitious a project for most organizations, or is there a better way?</p></body>

<body>Tim Morris shares a different approach with us today. It might require some convincing and some courage, but it seems much more likely to succeed than any of your past CMDB efforts…</body>

<body><p>Tim Morris shares a different approach with us today. It might require some convincing and some courage, but it seems much more likely to succeed than any of your past CMDB efforts…</p></body>

<body><ul><li><a rel="noopener" target="_blank" href="https://www.scworld.com/resource/trusted-automation-building-autonomous-it-with-confidence">Trusted automation: Building autonomous IT with confidence</a></li></ul></body>

<body>This segment is sponsored by Tanium. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/tanium">https://securityweekly.com/tanium</a> to learn more about them!</body>

<body><p>This segment is sponsored by Tanium. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/tanium">https://securityweekly.com/tanium</a> to learn more about them!</p></body>

<body>Segment 2 - Topic: the new White House cybersecurity strategy</body>

<body><h3>Segment 2 - Topic: the new White House cybersecurity strategy</h3></body>

<body>In this segment, we explore some early details about the White House's new, but yet unreleased cybersecurity strategy. It appears that drafts have been shared (or leaked) to the press, so there's <a rel="noopener" target="_blank" href="/www.cybrsecmedia.com/white-house-readies-five-page-cybersecurity-strategy-built-on-offense-deterrence-and-deregulation/)">plenty to discuss</a> here!</body>

<body><p>In this segment, we explore some early details about the White House's new, but yet unreleased cybersecurity strategy. It appears that drafts have been shared (or leaked) to the press, so there's <a rel="noreferrer noopener" target="_blank" href="//www.cybrsecmedia.com/white-house-readies-five-page-cybersecurity-strategy-built-on-offense-deterrence-and-deregulation/)">plenty to discuss</a> here!</p></body>

<body>Finally, in the enterprise security news,</body>

<body><p>Finally, in the enterprise security news, </p></body>

<body><ol><li>Massive amounts of funding and acquisitions as we get close to RSA</li><li>Open source registries need help</li><li>Microsoft Copilot reads email marked as DO NOT READ</li><li>Don’t use an LLM to generate passwords</li><li>is prompt injection a vulnerability</li><li>defining risks</li><li>AI changes the build versus buy equation</li><li>the scammer’s perspective</li></ol></body>

<body>All that and more, on this episode of Enterprise Security Weekly.</body>

<body><p>All that and more, on this episode of Enterprise Security Weekly.</p></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14477″} podcast from PPWorks

AI benefits/risks

Bringing intelligence to assets, new White House cybersecurity strategy, and the news – Tim Morris – ESW #447

<body>Title:
Keys Without People” — John Heasman on Cleaning Up Non-Human Access</body>

<body><p>Title:
Keys Without People” — John Heasman on Cleaning Up Non-Human Access</p></body>

<body>Summary:
John breaks today’s non-human identity mess into three buckets: core tools your business runs on, old/one-off integrations that linger, and engineer tokens left behind. His playbook is simple: decide what’s truly critical, assign a clear owner, keep access minimal, and review it on a schedule. With AI spawning even more “non-human users,” basics done well—prioritize, tighten, rotate, repeat—win the day.</body>

<body><p>Summary:
John breaks today’s non-human identity mess into three buckets: core tools your business runs on, old/one-off integrations that linger, and engineer tokens left behind. His playbook is simple: decide what’s truly critical, assign a clear owner, keep access minimal, and review it on a schedule. With AI spawning even more “non-human users,” basics done well—prioritize, tighten, rotate, repeat—win the day.</p></body>

<body>This segment is sponsored by Saviynt. Visit <a rel="noreferrer noopener" target="_blank" href="https://cisostoriespodcast.com/saviynt">https://cisostoriespodcast.com/saviynt</a> to learn more about them!</body>

<body><p>This segment is sponsored by Saviynt. Visit <a rel="noreferrer noopener" target="_blank" href="https://cisostoriespodcast.com/saviynt">https://cisostoriespodcast.com/saviynt</a> to learn more about them!</p></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14632″} podcast from PPWorks

Zero trust

Identity

Keys Without People — John Heasman on Cleaning Up Non-Human Access – John Heasman – CSP #220

Interior of a giant warehouse full of computer servers, endpoints, software packages and networking devices.

computer-server-warehouse-socialsight

Exposure management

Attack surface management

Cloud Security

Resource

Tenable

Shining a light: Why asset inventory is key to exposure management

<body>Interview with Tod Beardsley</body>

<body><h3>Interview with Tod Beardsley</h3></body>

<body>This interview is sponsored by runZero.</body>

<body><p>This interview is sponsored by runZero.</p></body>

<body>Legacy vulnerability management (VM) hasn't innovated alongside of attackers, and it shows. Let's talk about the state of VM.</body>

<body><p>Legacy vulnerability management (VM) hasn't innovated alongside of attackers, and it shows. Let's talk about the state of VM.</p></body>

<body>Check out <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/runzero">https://securityweekly.com/runzero</a> to learn more!</body>

<body><p>Check out <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/runzero">https://securityweekly.com/runzero</a> to learn more!</p></body>

<body>Topic Segment: NPM Incidents</body>

<body><h3>Topic Segment: NPM Incidents</h3></body>

<body>In this week’s topic segment, we’re discussing all the NPM supply chain attacks from the past 3 weeks.</body>

<body><p>In this week’s topic segment, we’re discussing all the NPM supply chain attacks from the past 3 weeks.</p></body>

<body>I recently published a roundup of these incidents <a rel="noreferrer noopener" target="_blank" href="https://defendersinitiative.substack.com/p/npm-another-pummeling-man">over on my Substack</a>.</body>

<body><p>I recently published a roundup of these incidents <a rel="noreferrer noopener" target="_blank" href="https://defendersinitiative.substack.com/p/npm-another-pummeling-man">over on my Substack</a>.</p></body>

<body><h3>Weekly Enterprise News</h3></body>

<body><ol><li>funding and acquisitions are going crazy</li><li>an exciting new canarytoken</li><li>banks have a more sedate approach to agentic</li><li>MCP security</li><li>the future Subprime Code crash of 2028</li><li>is security worried about the wrong risks?</li><li>botnets are back in the headlines</li><li>some bs research</li><li>journalists getting duped by AI</li><li>Animal crossing villagers are organizing against Tom Nook</li></ol></body>