# CISO Published articles for CISO. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Australia's Essential Eight replacement shifts cybersecurity compliance toward continuous exposure management DevFeed: [Australia's Essential Eight replacement shifts cybersecurity compliance toward continuous exposure management]() Original publisher: [Read original article]() Author: Ben Mudie Published: 2026-09-15T13:32:00Z Content type: article Language: en Sources: [Tenable Blog]() Topics: [Exposure Management](), [Cybersecurity](), [Security](), [Cloud](), [App]() Tags: [australia](), [ciso](), [cloud](), [compliance](), [cybersecurity](), [enterprise](), [essential-eight](), [exposure-management](), [identity](), [operational](), [organization]() ### AI overview The article describes Australia's replacement of the Essential Eight with an outcomes-focused cybersecurity framework covering enterprise IT, cloud, operational technology, and potentially agentic AI. It argues that organizations will need continuous evidence of their security posture, and presents exposure management as a way to identify and prioritize weaknesses and support current posture validation. ### Source excerpt Australia's move from the Essential Eight to an outcomes-based cybersecurity model will push organizations from conducting periodic point-in-time, checklist compliance assessments to having continuous evidence of a solid security posture. Key takeaways The Australian Signals Directorate (ASD) is moving from the Essential Eight cybersecurity framework to a new outcomes-focused Essentials series covering enterprise IT, cloud, operational technology (OT), and potentially agentic AI. The Essential Eight itself only ever covered on-premises enterprise IT, built around eight named technical controls, such as application control and patching. It never extended to the security of cloud, identity, or OT. The shift challenges the traditional checklist approach to cybersecurity, where organizations demonstrate compliance through periodic assessments and point-in-time reports. In dynamic environments spanning IT, cloud, identity, and OT, security posture can change quickly and repeatedly between assessments. Exposure management can help organizations continuously understand where they are exposed, prioritize the most critical weaknesses, and provide evidence of their current security posture. ASD's strategic shift to active security posture validation Can you prove your security posture is solid, right now, on demand? That's the question the Australian Signals Directorate (ASD) has effectively put in front of every Australian organization's board, CISO, and C-suite. ASD's decision to retire the Essential Eight signals a fundamental move away from point-in-time, checklist-based security toward an outcomes-focused model where organizations will need to demonstrate continuous compliance. It's no longer enough to show that your organization had a control in place at the time of the last assessment. In a technology environment that changes continuously across IT, cloud, identity, and operational technology (OT), organizations must be able to answer a much more immediate question: Ho ## EU DORA compliance for engineering teams DevFeed: [EU DORA compliance for engineering teams]() Original publisher: [Read original article]() Author: John Crowley Published: 2026-06-02T13:42:24Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [Resilience](), [Incident response](), [systems](), [monitor](), [Software](), [incident]() Tags: [ciso](), [compliance](), [engineering](), [eu](), [incident-response](), [infrastructure](), [monitor](), [operational](), [operations](), [real-time](), [resilience](), [software](), [systems](), [third-party](), [workflows]() ### AI overview This article explains how the EU Digital Operational Resilience Act (DORA) affects engineering teams supporting financial services in the EU. It outlines requirements for ICT asset inventories, incident reporting, operational resilience testing, and third-party risk management, and describes the need for accurate software ecosystem information and automated workflows. ### Source excerpt Understand how the EU Digital Operational Resilience Act (DORA) affects engineering teams, the four core compliance pillars, and how to streamline audit readiness. ## The Real Role of the Field CISO DevFeed: [The Real Role of the Field CISO]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-04-04T13:32:43Z Content type: article Language: en Sources: [Risk and Cyber]() Topics: [Security](), [reliability](), [Security & Privacy]() Tags: [ciso](), [cybersecurity](), [leadership](), [reliability](), [security]() ### AI overview The article discusses the role of Field CISOs and argues that security and reliability increasingly support sustainable, long-term customer success. ### Source excerpt We all need to advance our businesses and that is in many respects about selling. We also need to recognize that security and reliability are increasingly the path to sustainable long term customer success - which is your success. This is where the Field CISOs come in. There are many more people that are becoming, so called, Field CISOs and many more organizations that are creating Field CISO teams under a variety of structures and names. Let's look at what Field CISOs are, why they exist,... ## The CISO's Craft: Watchmaker or Gardener? DevFeed: [The CISO's Craft: Watchmaker or Gardener?]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-01-24T16:39:53Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Security](), [Cybersecurity]() Tags: [ciso](), [craft](), [cybersecurity](), [leadership](), [precision](), [security]() ### AI overview The article considers whether security leaders should operate more like precise watchmakers, adaptive gardeners, or both when leading organizational transformations. It also argues that cybersecurity benchmarking should focus on control effectiveness and outcomes rather than inputs such as budgets. ### Source excerpt Some time ago I saw a comment about the distinction between acting like a "watchmaker" or a "gardener" when undertaking organization transformations. I misplaced the original reference so, unfortunately, I can't credit appropriately. But, I've been thinking a lot about what this would mean in the context of security leadership. Specifically, should the CISO be a watchmaker or a gardener, or both? The Watchmaker CISO: Precision and Control Imagine a master watchmaker, meticulously crafting... ## Seeking symmetry during ATT&CK® season: How to harness today's diverse analyst and tester landscape to paint a security masterpiece DevFeed: [Seeking symmetry during ATT&CK® season: How to harness today's diverse analyst and tester landscape to paint a security masterpiece]() Original publisher: [Read original article]() Author: Márk Szabó James Shepperd Ben Tudor Published: 2025-12-10T15:03:51Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Endpoint Security & XDR](), [Cybersecurity](), [Resilience](), [Detection engineering](), [Threat Research]() Tags: [2025](), [analysts](), [article](), [attacks](), [business-security](), [ciso](), [cybersecurity](), [endpoint-security](), [enterprise](), [incident](), [industry](), [infrastructure](), [practitioner](), [report](), [resilience](), [security](), [testing]() ### AI overview The article explains how security practitioners can interpret and connect cybersecurity reports and tests from analyst firms and independent testing labs. It focuses on endpoint security, including product evaluations, feature testing, broader market analyses, and assessments against known advanced adversary attacks, to support more informed protection-stack and purchasing decisions. ### Source excerpt Interpreting the vast cybersecurity vendor landscape through the lens of industry analysts and testing authorities can immensely enhance your cyber-resilience. ## Empowering women in security: The impact of mentorship DevFeed: [Empowering women in security: The impact of mentorship]() Original publisher: [Read original article]() Author: Erin Cullen Published: 2024-11-27T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Cybersecurity](), [Security](), [Business Security]() Tags: [awareness](), [blog](), [career-development](), [career-growth](), [ciso](), [collaboration](), [community](), [cybersecurity](), [developer](), [industry](), [megawatt](), [security](), [series](), [snyk]() ### AI overview This article explores how mentorship and allyship can help women enter and advance in cybersecurity. It highlights supportive leaders, non-traditional career paths, advocacy for promotions and raises, and the importance of confidence, collaboration, and professional networks in building a more inclusive security community. ### Source excerpt In the Women Leading Security series, Snyk CMO Jonaki Egenolf spoke with influential leaders about challenges and opportunities in the journey toward a more inclusive cybersecurity industry. ## How Axel Springer National Media and Tech achieved continuous security with Snyk DevFeed: [How Axel Springer National Media and Tech achieved continuous security with Snyk]() Original publisher: [Read original article]() Author: Nina McClure Published: 2024-09-03T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Vulnerabilities](), [snyk-open-source](), [Application Security](), [snyk-code](), [Static code analysis](), [Infrastructure as code](), [Development](), [Amazon Web Services](), [Containers](), [Open Source]() Tags: [application-security](), [awareness](), [aws](), [blog](), [ciso](), [code-security](), [containers](), [customer](), [customer-featured](), [development](), [devops](), [executive](), [iac](), [interest](), [megawatt](), [open-source-security](), [security](), [shift-left](), [snyk](), [snyk-code](), [snyk-open-source](), [vulnerabilities]() ### AI overview This customer story describes how Axel Springer National Media and Tech adopted Snyk after Log4Shell to help developers find and fix vulnerabilities earlier. It covers the implementation of Snyk Code and Snyk Open Source within existing development processes, alongside developer-managed IaC on AWS and security responsibilities shared across teams. ### Source excerpt Find out how Axel Springer's National Media & Tech business division uses Snyk to empower its developers to find and fix vulnerabilities in their own code. ## Developer and CISO perspectives on software supply chain security DevFeed: [Developer and CISO perspectives on software supply chain security]() Original publisher: [Read original article]() Published: 2024-05-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [container images](), [chainguard]() Tags: [chainguard](), [ciso](), [communications-gap](), [container-images](), [developers](), [security](), [security-tools](), [shared-responsibility](), [software-supply-chain](), [software-supply-chain-security]() ### AI overview This article presents ten insights from Chainguard and Harris Poll's 2023 CISO & Developer Trends in Software Supply Chain Security Report. It describes developers' concerns about security tools, productivity, communication, shared responsibility, expertise, organizational priorities, and tensions between developers and CISOs. ### Source excerpt Bridge the dev-security gap! Learn essential insights for fostering a collaborative, secure development environment. ## Day in the life of a food giant CISO DevFeed: [Day in the life of a food giant CISO]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2024-04-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Cybersecurity](), [Application Security](), [cloud-infrastructure](), [engineering-culture](), [Architecture & Design]() Tags: [application-security](), [awareness](), [blog](), [ciso](), [cloud](), [compliance](), [devrel](), [devsecops](), [executive](), [governance](), [leadership](), [management](), [organizational](), [product-security](), [security](), [security-engineering](), [strategy]() ### AI overview This developer-focused interview profiles Sherif Mansour, Just Eat's Director of Information Security, and discusses his career, Just Eat's three-line information security model, and his responsibilities across platform security, cloud and infrastructure, product security, application security, security engineering, culture, and awareness. It also describes organizational leadership principles and a themed weekly schedule for managing priorities. ### Source excerpt Snyk's Vandana Verma Sehgal sat down with Sherif Mansour, the Director of InfoSec at JustEat, for a "Day in the life of a CISO" session to learn more about his day-to-day experience as a security leader. ## Reporting AppSec risk up to your CISO DevFeed: [Reporting AppSec risk up to your CISO]() Original publisher: [Read original article]() Author: Kate Powers Burke; Ezra Tanzer Published: 2024-02-13T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Security](), [supply-chain-security](), [vulnerability]() Tags: [application-security](), [blog](), [ciso](), [pmm](), [security](), [security-tools](), [snyk-platform](), [software-supply-chain](), [vulnerability]() ### AI overview This article explains how AppSec teams can report prioritized application security risk to CISOs. It emphasizes clear reports, concise risk summaries, holistic visibility across code-based assets and software supply chains, and contextual prioritization beyond vulnerability counts and scores. ### Source excerpt Learn what information CISOs need to know about your application security program in order to have a clear understanding of risk. ## New report shows disconnect between developers and security teams on software supply chain security priorities and responsibilities DevFeed: [New report shows disconnect between developers and security teams on software supply chain security priorities and responsibilities]() Original publisher: [Read original article]() Published: 2023-11-08T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [Security](), [developer velocity](), [Open Source]() Tags: [chainguard](), [ciso](), [container-security](), [developer-velocity](), [developers](), [open-source](), [report](), [security](), [software-developer](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-research](), [survey]() ### AI overview Chainguard and The Harris Poll released a 2023 survey of CISOs and developers about software supply chain security. The report found that both groups consider it important but differ in their views of security awareness, responsibilities, tooling, and associated risks. ### Source excerpt Chainguard's new report reveals a crucial gap between developers and security teams on software supply chain priorities. ## Securing Diversity in Cybersecurity DevFeed: [Securing Diversity in Cybersecurity]() Original publisher: [Read original article]() Author: Kristen Beneduce Published: 2023-05-02T13:01:51Z Content type: opinion Language: en Sources: [Nextdoor]() Topics: [Cybersecurity](), [Security & Privacy]() Tags: [ciso](), [culture](), [cybersecurity](), [diversity](), [engienering](), [events](), [inclusion](), [industry](), [innovation](), [rsa-conference](), [security]() ### AI overview Nextdoor discusses the representation gap in cybersecurity and its partnership with WiCyS Silicon Valley during an RSAC 2023 diversity event. The article highlights barriers affecting women in cybersecurity and argues that diverse teams improve problem-solving and innovation. ### Source excerpt Panelists from Left to Right: Ronit Polak (Moderator), Kathy Wang* , Lea Kissner, Rupa Parameswaran, Olivia Rose, Jameeka Green Aaron *Correction: Kathy Wang is the former, not current CISO of Discord At Nextdoor we build technology that empowers resilient, safe, and kind neighborhoods all over the world. Securing a product that empowers global communities requires diverse and inclusive teams, reflective of the communities we support. Yet hiring and retaining the diverse talent needed to achieve our purpose remains an industry challenge. The gap is particularly evident in the cybersecurity field where 25% of the workforce and 16% of CISOs identify as female. According to the WiCyS State of Inclusion report 2023, women cite lack of respect and limited opportunities for growth in cybersecurity as top challenges accompanying lack of representation. We must keep working on it. That is why Nextdoor welcomed the chance to celebrate diversity, alongside RSAC 2023, in Nextdoor HQ's backyard this week and to partner with our neighborhood Women in Cybersecurity (WiCyS) Silicon Valley chapter. We are committed to building a diverse and inclusive workplace, and we are proud to work with organizations like WiCyS, who share the same values. Nextdoor's CISO TC Niedzialkowski kicked off with a warm welcome. CEO Sarah Friar framed the discussion by sharing how she launched her career by building a network at her first RSA conference as an equity analyst for Security Software at Goldman Sachs. She emphasized that diverse teams bring a variety of perspectives and experiences to the table, which ultimately leads to better problem-solving and innovation. Left to Right: Tanvi Kolte Tiwari (WiCyS Silicon Valley Events Chair) introducing the panel, Attendees soaking into a fantastic intro by Sarah Friar (Nextdoor CEO) , TC Niedzialkowski (Nextdoor CISO) cheering on the panel Moderator Ronit Polak, WiCyS Silicon Valley President, and CISOs Kathy Wang Lea Kissner Rupa Parameswaran Olivia Ros ## The Uber CSO indictment DevFeed: [The Uber CSO indictment]() Original publisher: [Read original article]() Author: Adam Published: 2020-08-28T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [infosec](), [data]() Tags: [breach](), [ciso](), [department-of-justice](), [disclosure](), [ftc](), [infosec](), [law]() ### AI overview An analysis of the Uber CSO indictment and Mark Rasch's essay on concealing and failing to report a data breach. The article emphasizes due process for Joe Sullivan and argues that the case may make organizations and lawyers more cautious about breach disclosures, potentially reducing their usefulness for learning from mistakes. ### Source excerpt Thoughts on Mark Rasch's essay, Conceal and Fail to Report - The Uber CSO Indictment