Jon Clay

𝗔𝗿𝗲 𝗵𝗼𝘁𝗲𝗹𝘀 𝘂𝗻𝗱𝗲𝗿 𝗮𝘁𝘁𝗮𝗰𝗸? For my next post highlighting sponsors of the PCI AP and EU Community Meetings (CM), I am featuring VikingCloud.  https://lnkd.in/gXvJnNm5 Thank you to the VikingCloud team! I appreciate you signing up as the: (a) Premium Sponsor (the highest tier!) covering the Vendor Showcase at the North America Community Meeting; (b) Platinum Sponsor (top sponsor) covering the Welcome Reception at the Europe Community Meeting; and (c) Support Sponsor covering the coffee sleeves at the AP Community Meeting.   PCI events are expensive to host and your sponsorships help us to offset the cost of the events! Hotels are an obvious target because they are a major merchant category, highly visible and accept lots of payments, both online and in-person. Based on VikingCloud’s 2025 State of Hospitality Cyber Report, 66% of hotel IT and cybersecurity leaders report more frequent cybersecurity attacks and 50% said that the attacks are more severe.  Download the report here: https://lnkd.in/gggJdvKd Last week, I received an email from a leader of a hotel belonging to a large hotel chain.  He has received notification to submit their PCI DSS documentation and the leader has no idea what to do… 🤷‍♂️ If you operate a business that must adopt PCI DSS, do send your staff for training or engage someone who can help you.  PCI conducts many in-person and virtual trainings through the year.  Look into the PCI ISA (Internal Security Assessor) or PCIP (PCI Professional Training) trainings. https://lnkd.in/gcA4hPxS And there are many PCI QSA (Qualified Security Assessors) around the world who can assist you. QSAs are independent cybersecurity companies who perform PCI DSS security assessments. They are trained and licensed by PCI Council. https://lnkd.in/gpH8V7Cp If you do not have the expertise to manage the compliance or protect your systems (and your brand reputation), do get help. VikingCloud cited that more than 80% of hotels were able to resolve incidents within 12 hours when they engaged an MSSP. Thanks for sharing your insights, VikingCloud! As a PCI GEAR (Global Executive Assessors Roundtable) member representing the PCI assessor community, do share these insights with the PCI leaders during your quarterly meetings to influence and improve PCI standards. Disclaimer: PCI Council is a neutral body and my personal post is not an endorsement of any organization or solution. PCI Security Standards Council #pcissc #pcicommunity #pcidss #pcidssv4 #datasecurity #cybersecurity #payments #paymentsecurity Video credit: Thank you Canva for your platform and the royalty-free video.

23

3 Comments

🚨 Just released: Corero’s 2025 Threat Intelligence Report 🚨 DDoS atacks are no longer just big floods.They're frequency, evasion, and protocol pivoting. Key insights: • 11 attacks/day avg. in 2024 • Mid-size attacks declining • Multi-vector attacks on the rise Read the release: https://bit.ly/44kLkn0

15

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

Learn how to establish a robust Data Loss Prevention (DLP) program. Start by exploring the DLP strategy and maturity model to understand the key components. Then, take the next step and book an appointment for personalized guidance to tailor the program to your specific needs.

3

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

Exploitation timelines are increasingly measured in days rather than weeks. Our latest report from Rapid7 Labs correlates vulnerability publication data, confirmed exploitation trends, frontline MDR incident response telemetry, and dark web, cybercrime, and nation-state intelligence to provide a unified view of how exposure evolves into compromise. One of the biggest standouts: how rapidly AI is being integrated into attacker playbooks, accelerating the operationalization of exposure. Many of the incidents we investigate still originate from known, unaddressed exposure. In those cases, attackers don’t need sophistication - they need opportunity. As remediation windows shrink, reducing that opportunity becomes essential to limiting compromise. You can download the 2026 Global Threat Landscape report here: https://r-7.co/4bQOAtq #infosec #cybersecurity

37

1 Comment

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

We help you cut through the noise when choosing the right Managed Detection and Response (MDR) solution. Get the clarity you need. This MDR Buyer's Guide slices through the noise and delivers straight answers. It covers: -The essential services an MDR provider should offer -The superior outcomes you should expect from a best-in-class MDR service -Top questions to ask a potential MDR provider -An introduction to Sophos MDR, the world’s highest-rated and most-reviewed MDR service Download the guide and take the first step toward smarter protection: https://lnkd.in/eM9Pn4n6

3

1 Comment

✳️DFARS Update Alert ✳️ DoW’s new class deviation (DARS 2026‑O0025) reorganizes—not expands—cybersecurity requirements. DFARS Part 240 and new clause 252.240‑7997 now centralize NIST SP 800‑171 Medium/High assessment access, precedence, and SPRS posting when the deviation is used. Key point: 7012, 7008, and all CMMC requirements remain fully in force. CMMC Level 2 (Self) is not eliminated. What changes is how DoW manages and prioritizes its own NIST 800‑171 assessments At CorpInfoTech, we closely track regulatory changes to help defense contractors navigate compliance with confidence and strengthen their security posture. DFARS Assessment Changes Explained: Practical Impacts for Contractors https://hubs.li/Q042vp4Q0 #CMMC #DefenseContractors #DFARS #NIST800171 #DoW #DoD #DiB

4

Manufacturing cybersecurity requires approaches that account for operational continuity as much as threat prevention. This OPSWAT webinar explores how proven technologies are deployed to protect industrial systems from file-based threats while allowing organizations to maintain safe and uninterrupted production.

3

𝗠𝗼𝘀𝘁 𝗰𝘆𝗯𝗲𝗿 𝗿𝗶𝘀𝗸 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁𝘀 𝘀𝘁𝗮𝗿𝘁 𝘄𝗶𝘁𝗵 𝗮𝘀𝘀𝗲𝘁 𝗶𝗻𝘃𝗲𝗻𝘁𝗼𝗿𝗶𝗲𝘀 & 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗰𝗵𝗲𝗰𝗸𝗹𝗶𝘀𝘁𝘀 - 𝗯𝘂𝘁 𝗱𝗼𝗻’𝘁 𝗽𝗿𝗼𝘃𝗲 𝘄𝗵𝗲𝘁𝗵𝗲𝗿 𝗱𝗲𝗳𝗲𝗻𝘀𝗲𝘀 𝘄𝗼𝘂𝗹𝗱 𝗵𝗼𝗹𝗱 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗿𝗲𝗮𝗹 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀. Gartner’s Threat-Informed Defense Effectiveness (TiDE) reframes cyber risk, helping leaders base decisions on how attackers actually operate - by validating end-to-end scenarios across protect, detect, respond, and recover (PDRR), not relying on assumptions. Download the complimentary Gartner® TiDE report and see how security teams are building cyber resilience through proof: https://okt.to/FeVH3l Gartner

13

From Citrix pivots to legacy exposures, attackers are breaching the OT DMZ in stealthy and effective ways. At #DEFCON33, Christopher Nourrie dives into red team insights from the front lines—and what defenders must do to keep OT safe. #ICS #CyberDefense #NetworkSecurity

70

Overview of the 2025 SANS State of ICS/OT Security Survey The report’s clear message: Treat compliance as a baseline, not the goal. Prioritize visibility, faster remediation Key Findings (Direct from the Report) Incidents remain high and disruptive: 22% of organizations reported a cybersecurity incident in the past 12 months. – 40% caused operational disruption. – Nearly 20% took over a month to remediate (3% took over a year). – Top causes: Unauthorized external access (50%), ransomware (38%). Detection is improving, but recovery lags: – ~50% of incidents detected within 24 hours. – 60% contained within 48 hours total. – Remediation still takes days/weeks on average — a persistent weak spot. Regulation drives maturity: Regulated sites had the same incident rate as unregulated peers but experienced ~50% fewer financial losses and safety impacts. Threat intelligence pays dividends: 67% of organizations use it (mostly vendor feeds, government sources, and ISACs). Those who do are far more likely to improve monitoring, segmentation, and detection. Remote access remains a top risk: It accounted for half of all incidents, yet only 13% of organizations have fully implemented advanced controls (e.g., session recording, ICS/OT-aware access, real-time approvals). Preparedness is uneven: Only 14% feel fully prepared for emerging threats. However, organizations that include frontline technicians in exercises are 1.7× more likely to report strong readiness. Investment momentum is clear: Asset visibility, threat detection, and secure remote access dominate both 2025 deployments and 2026–2027 plans. Additional Notable Insights Incident Response (IR): 57% now have a dedicated ICS/OT IR plan (70% at regulated + threat-intel sites). Testing is increasing (25% quarterly). Those who test regularly also run more realistic drills (red/purple team, operational exercises). Visibility & Detection: Only 13% have full ICS Cyber Kill Chain visibility. 49% use some ICS/OT-specific detection, but just 26% rate it “highly effective.” Cloud monitoring is patchy (only 13% fully integrated). Future Threat Outlook: Respondents see rising risks to edge/IoT devices (60%), legacy systems (54%), and cloud-connected OT (53%). Ransomware targeting OT is the #1 scenario considered in planning (72%). Purdue Model Gaps: Detection is strongest at higher levels (Level 4/3); visibility drops sharply at Level 2, Level 1, and especially remote/field sites. Resilience & Culture: Cybersecurity is still only partially integrated into business continuity/disaster recovery plans for most organizations. Stronger culture (IT–OT–leadership alignment) is clearly linked to having an ICS-specific IR plan. Who’s Ahead? Fully prepared organizations (the top 14%) share traits: full Kill Chain visibility, advanced remote-access controls, active information sharing, and heavy involvement of field technicians/engineers in exercises. https://www.sans.org

5

⚠️ Exposure Management is a critical aspect of any strong security program, but simply having a list of vulnerabilities isn't enough. That’s because attackers aren’t just looking for a single vulnerability. They’re looking for "toxic combinations," which are recipes for exploitation. Claroty xDome’s Exposure Scenarios provides an attacker's view of your environment, eliminating toxic combinations and delivering actionable risk reduction recommendations. Find out more: https://gag.gl/2QbFEJ #ExposureManagement #Claroty #xDome

3