Security Insights

Non-human identities: the rise of the machines

Non-human identities now vastly outnumber human actors on the internet, perhaps by as many as 50 to one.

APIs, online devices and service calls now dominate internet traffic, and access requests.

And this is only set to increase, with the rise of AI and AI agents.

Could we even see "robot wars" as AI agents take on AI defenders?

A lack of visibility, and a lack of control over machine identities is not just putting systems and networks at risk.

It is changing the whole concept of identity.

Now, it's no longer a question of who has access to our systems and data, but what. And the consequences for cybersecurity are far reaching.

Our guest is Art Gilliland, CEO at Delinea. Interview by Stephen Pritchard

Balancing risk and security: Rich Seiersen

Managing cybersecurity is increasingly about managing risk.

It's not possible to stop every attack or prevent every breach. So CISOs need to link the likelihood and impact of an incident to the damage it does to the organisation.

But do security teams understand business risk? And do business leaders fully appreciate the threat from cyber attacks?

Our guest is Richard Seiersen, chief risk technology officer at Qualys, as well as a researcher, author, entrepreneur and former CISO.

Cyber Security Foundations: security by the book

Can a book hold the answers to our cybersecurity challenges?

Perhaps not. But a new book from the Information Security Group at Royal Holloway, University of London, sets out to act as a primer on cybersecurity.

The target audience is both those setting out on a career in the sector, or general readers who want to understand the core principles of cybersecurity.

The book is called Cyber Security Foundations: Fundamentals, Technology and Society, published by Kogan Page. In this episode, we ask three of it authors how it came into being, and how a written text can keep pace with a fast-changing security landscape.

Verizon's DBIR: tracking security threats

Verizon's Data Breach Investigations Report is one of the longest-running research studies in the industry.

This year's report is the 18th and tracks over 20,000 incidents and 12,000 breaches.

What changes are we seeing, and what can CISOs learn from the data?

Our guest is Ashish Khanna, who runs the security solutions and consulting practice at Verizon Business. Interview by Stephen Pritchard

Beyond the Titanic: Cybersecurity in Northern Ireland

In this episode, we look at the growth of the cybersecurity industry in Northern Ireland.

What are the reasons for its success, and why does cyber play an important part in Northern Ireland's post-industrial future? And why should CISOs look there for a source of talent?

Our guest is Simon Whittaker, chair of the steering committee for NI Cyber, and CEO of Vertical Structure, now part of Instil.

CISO Interview: Mandy Andress, Elastic

Our guest this week is Mandy Andress is CISO at Elastic.

Elastic describes itself as a “search AI company”, and is very much at the forefront of modernising enterprise technology.

A host of businesses use Elastic's tools behind the scenes to manage their data, for security and, of course, for AI.

As CISO, Mandy Andress has the dual responsibilities of keeping Elastic secure, and advising customers on security.

In this CISO interview, we hear about her route into cybersecurity and the pressures of dealing with the increasing intensity, or velocity of cyber attacks.

And we discuss why CISOs need to be more aware than ever of their role in providing security not just within their own organisations but across national infrastructure, and the wider economy.

Insights Interview: Claudia Natanson, UK Cyber Security Council

Dr Claudia Natanson is CEO at the UK Cyber Security Council.

The Council, which is funded by the Government's Department for Science, Innovation and Technology, acts as an umbrella body for a range of professional bodies in cybersecurity.

It is the organisation behind chartered status for cybersecurity professionals, sets standards and publishes an ethics code, and acts as a voice of the industry: quite a broad mission for an organisation that is only a few years old.

The Council is, though, very well placed to assess the health of the cybersecurity industry across the UK. And, as Dr Natanson says, it faces a number of challenges, including recruitment, retention, diversity, and ensuring organisations understand what they need from their cybersecurity teams.

But what, exactly, does pouring the perfect pint of Guinness have to do with a successful career in cyber?

Interview by Stephen Pritchard

Episode 125: Insights Interview, with James Bore

Our guest for the 125th episode of Security Insights is James Bore.

A well-known industry figure and speaker on cybersecurity, James runs the family consultancy firm Bores. He's also an author, book publisher, cyber skills trainer and volunteer.

In this Insights Interview, he shares his forthright -- and sometimes controversial -- views on the way forward for cybersecurity, with editor Stephen Pritchard.

Does cybersecurity blame the victim? What is the relationship between trust and security? And why is investment in security sometimes a bad thing?

 

Why CISOs quit: cyber's leadership crisis

Are CISOs leaving the industry in droves?

One survey suggests that as many as one in four senior cybersecurity leaders plans to leave the profession.

The causes include growing responsibilities, increasingly severe threats and ever-greater regulatory burdens.

The result is stress and burn out, with CISOs constantly fighting fires. As one of our guests says, CISOs suffer from an "invisibility of success".

So what can we do? The first step is to recognise the problem; the second is to help CISOs build both organisational and individual resilience.

Our guests are Darren Williams, founder and CEO of BlackFog, which commissioned the research, and Peter Coroneos, founder of mental health not for profit Cybermindz.

Stress testing cyber defences

How far should you push security tests?

Sometimes, the answer is "to the limit".

In this episode we look at stress testing in cybersecurity. Putting systems under pressure is the only true way to check that they will work, as intended, during a cyber attack.

But how does stress testing differ from pentesting and cyber exercises? How far is too far, and how do security teams capture the right lessons from the testing process?

Our guests are Chris McKean, solutions specialist at NetApp, and Simon Edwards, founder and CEO at SE Labs.