CSO Online | Security at the speed of business

You’re always a target, so it pays to review your cybersecurity insurance

Not only does an annual insurance review ensure compliance with policy requirements, it can kick off a more thorough review of your security posture that goes far beyond requirements for coverage.

By Susan Bradley

Apr 11, 20257 mins

CSO and CISOInsurance IndustrySecurity Practices

Top 16 OffSec, pen-testing, and ethical hacking certifications

By Eric Frank

Apr 10, 202516 mins

CertificationsIT TrainingPenetration Testing

Is HR running your employee security training? Here’s why that’s not always the best idea

By Linda Rosencrance

Apr 9, 20259 mins

CSO and CISOHuman ResourcesIT Training

Trump revokes security clearances for Chris Krebs, SentinelOne in problematic precedent for security vendors

By Cynthia Brumfield

Apr 10, 20257 mins

GovernmentGovernment ITTechnology Industry

Lessons learned about cyber resilience from a visit to Ukraine

By Christopher Burgess

Apr 9, 20255 mins

CSO and CISOMilitarySecurity Practices

US bank regulator’s email system breached

By Paul Barker

Apr 8, 20255 mins

Data BreachEmail Security

April Patch Tuesday news: Windows zero day being exploited, 'big vulnerability' in 2 SAP apps

By Howard Solomon

Apr 8, 20258 mins

Threat and Vulnerability ManagementVulnerabilitiesWindows Security

10 things you should include in your AI policy

By Maria Korolov

Apr 8, 202513 mins

Generative AIIT Governance FrameworksIT Training

10 best practices for vulnerability management according to CISOs

By Jon Oltsik

Apr 2, 20257 mins

CSO and CISOIT LeadershipThreat and Vulnerability Management

More security news

OpenAI slammed for putting speed over safety

Testers allege newer models are being pushed for launch with much-reduced testing time.

By Shweta Sharma

Apr 11, 2025 4 mins

Generative AISecurity

Russian Shuckworm APT is back with updated GammaSteel malware

The attack targeted the military mission of a Western country in Ukraine, with the goal of deploying a PowerShell-based version of the GammaSteel infostealer.

By Lucian Constantin

Apr 10, 2025 5 mins

Advanced Persistent ThreatsCyberattacksMalware

Oracle admits breach of ‘obsolete servers,’ denies main cloud platform affected

“No OCI customer environment has been penetrated,” the company insisted, but the hacker says otherwise.

By John E. Dunn

Apr 10, 2025 5 mins

Cloud SecurityData BreachSecurity

Hackers target SSRF flaws to steal AWS credentials

Buggy websites hosted on EC2 instances can allow attackers to send unauthorized access requests for exposed EC2 instance metadata.

By Shweta Sharma

Apr 10, 2025 3 mins

SecurityVulnerabilities

Fortinet embeds AI capabilities across Security Fabric platform

Fortinet added FortiAI support to its core Security Fabric platform to strengthen protection from threats and simplify network and security operations.

By Michael Cooney

Apr 10, 2025 1 min

Network Security

Why Codefinger represents a new stage in the evolution of ransomware

Forget typical ransomware! Codefinger hijacked cloud keys directly, exposing backup flaws and shared responsibility risks. Time to rethink defense.

By Justin Giardina

Apr 10, 2025 6 mins

Cloud SecurityCyberattacksRansomware

Targeted phishing gets a new hook with real-time email validation

Cybercriminals are using precision-validated phishing to evade detection and steal credentials.

By Howard Solomon

Apr 9, 2025 5 mins

Email SecurityPhishingSecurity

Google launches unified enterprise security platform and AI security agents

Based on Gemini AI, the agents aim to automate various security functions, including alert triage, to free up resources for security teams.

By Lucian Constantin

Apr 9, 2025 5 mins

Cloud SecurityEndpoint ProtectionGoogle Cloud Next

Whatsapp plugs bug allowing RCE with spoofed filenames

Threat actors could trick users into running malicious code sent within crafted files with mismatched names.

By Shweta Sharma

Apr 9, 2025 3 mins

SecurityVulnerabilities

Chinese ToddyCat abuses ESET antivirus bug for malicious activities

The DLL search order hijacking vulnerability allows attackers to trick Windows into executing malicious DLLs.

By Shweta Sharma

Apr 8, 2025 3 mins

MalwareSecurityVulnerabilities

Why DEI is key for a cyber safe future

Diversity, equity, and inclusion (DEI) can be a cyber superpower — not just for reducing security skills gaps but for ensuring cybersecurity teams make defenses stronger and more adaptive.

By Bridget Chan, Camille Stewart Gloster and Katelyn Ringrose

Apr 8, 2025 5 mins

CybercrimeDiversity and InclusionHuman Resources

Warning to developers: Stay away from these 10 VSCode extensions

Malicious extensions that install a cryptominer were released just as the weekend started.

By Howard Solomon

Apr 7, 2025 4 mins

DeveloperMalwareVulnerabilities

Explore a topic

In depth

Who owns your data? SaaS contract security, privacy red flags

Companies looking to use SaaS solutions should involve the security team in the procurement process and pay attention to contract language.

By Andrada Fiscutean

Mar 27, 202410 mins

Data and Information Security

Read the Article

Upcoming Events

15/May

Show me more

CISA under review: Trump memo spurs scrutiny and uncertainty

By Nidhi Singal

Apr 10, 20251 min

Security

SpyCloud Research Shows that Endpoint Detection and Antivirus Solutions Miss Two-Thirds (66%) of Malware Infections

By Cyber NewsWire – Paid Press Release

Apr 7, 20254 mins

CyberattacksSecurity

PoisonSeed targets Mailchimp, Mailgun, and Zoho to phish high-value accounts

By Shweta Sharma

Apr 7, 20253 mins

PhishingSecurity

CSO Executive Sessions: How AI and LLMs are affecting security in the financial services industry

Mar 20, 202513 mins

CSO and CISOFinancial Services IndustrySecurity Operations Center

CSO Executive Sessions: How cybersecurity impacts company ratings – A fey factor for investors and consumers

Feb 12, 202527 mins

Security

CSO Executive Sessions: Guardians of the Games – How to keep the Olympics and other major events cyber safe

Aug 7, 202417 mins

CSO and CISO

Standard Chartered’s Alvaro Garrido on AI threats and what CIOs/CISOs must know in their AI journey

Apr 10, 202514 mins

CIOCSO and CISOFinancial Services Industry

CSO Executive Sessions: How AI and LLMs are affecting security in the financial services industry

Mar 20, 202513 mins

CSO and CISOFinancial Services IndustrySecurity Operations Center

CSO Executive Sessions: How cybersecurity impacts company ratings – A fey factor for investors and consumers

Feb 12, 202527 mins

Security

You’re always a target, so it pays to review your cybersecurity insurance

Top 16 OffSec, pen-testing, and ethical hacking certifications

Is HR running your employee security training? Here’s why that’s not always the best idea

Trump revokes security clearances for Chris Krebs, SentinelOne in problematic precedent for security vendors

Lessons learned about cyber resilience from a visit to Ukraine

US bank regulator’s email system breached

April Patch Tuesday news: Windows zero day being exploited, 'big vulnerability' in 2 SAP apps

10 things you should include in your AI policy

10 best practices for vulnerability management according to CISOs

More security news

OpenAI slammed for putting speed over safety

Russian Shuckworm APT is back with updated GammaSteel malware

Oracle admits breach of ‘obsolete servers,’ denies main cloud platform affected

Hackers target SSRF flaws to steal AWS credentials

Fortinet embeds AI capabilities across Security Fabric platform

Why Codefinger represents a new stage in the evolution of ransomware

Targeted phishing gets a new hook with real-time email validation

Google launches unified enterprise security platform and AI security agents

Whatsapp plugs bug allowing RCE with spoofed filenames

Chinese ToddyCat abuses ESET antivirus bug for malicious activities

Why DEI is key for a cyber safe future

Warning to developers: Stay away from these 10 VSCode extensions

Explore a topic

Popular topics

Generative AI

The risks of entry-level developers over relying on AI

AI programming copilots are worsening code security and leaking more secrets

AI disinformation didn’t upend 2024 elections, but the threat is very real

Cybercrime

Malicious actors increasingly put privileged identity access to work across attack chains

11 ways cybercriminals are making phishing more potent than ever

US charges 12 Chinese hackers in major government-backed espionage campaign

Careers

The CSO guide to top security conferences

11 hottest IT security certs for higher pay today

8 obstacles women still face when seeking a leadership role in IT

IT Leadership

Veterans are an obvious fit for cybersecurity, but tailored support ensures they succeed

6 hard-earned tips for leading through a cyberattack — from CSOs who’ve been there

Even anti-scammers get scammed: security expert Troy Hunt pwned by phishing email

In depth

Who owns your data? SaaS contract security, privacy red flags

Podcasts

Strengthen and Streamline Your Security

Episode 3: The Zero Trust Model

Episode 4: Reduce SOC burnout

Upcoming Events

FutureIT Los Angeles

FutureIT Dallas

FutureIT New York

Show me more

CISA under review: Trump memo spurs scrutiny and uncertainty

SpyCloud Research Shows that Endpoint Detection and Antivirus Solutions Miss Two-Thirds (66%) of Malware Infections

PoisonSeed targets Mailchimp, Mailgun, and Zoho to phish high-value accounts

CSO Executive Sessions: How AI and LLMs are affecting security in the financial services industry

CSO Executive Sessions: How cybersecurity impacts company ratings – A fey factor for investors and consumers

CSO Executive Sessions: Guardians of the Games – How to keep the Olympics and other major events cyber safe

Standard Chartered’s Alvaro Garrido on AI threats and what CIOs/CISOs must know in their AI journey

CSO Executive Sessions: How AI and LLMs are affecting security in the financial services industry

CSO Executive Sessions: How cybersecurity impacts company ratings – A fey factor for investors and consumers