Let's Clear The Air
This week: HOU.SEC.CON is now CYBR.SEC.CON, Cyber Sunday is now CYBR.Signal, and Chris Wysopal is done waiting for the industry to fix itself.
Vulnerability Management
Why Security Tools Fail to Reduce Risk: The Cybersecurity Shelfware Problem
Chris Wysopal warns that buying security tools without fixing vulnerabilities creates activity, not risk reduction.
AI Found Seven FatFs Bugs. Now Someone Has to Fix the Devices
AI uncovered seven FatFs flaws affecting embedded devices. The challenge now is patching millions of systems with no easy fix.
The CVE Stampede Is a Distraction, Finding the Vulns that Matter is the Challenge
With 48,000+ CVEs published annually, the challenge isn't volume. It's finding the vulnerabilities attackers will actually exploit.
Follow Friday: 5 Must-Read Cybersecurity Picks This Week
Discover five must-read cybersecurity articles, videos, and creators every security professional should follow this week.
Federal Agency or Not: How BOD 26-04 Is Coming for your Vulnerability Management Program
CISA's BOD 26-04 tells federal agencies how fast to patch. It's quietly telling everyone else the same thing: through insurance underwriting, vendor contracts, and regulatory alignment.
From CVSS to KEV, CISA Rewrites Federal Patching Priorities
The agency’s new directive replaces blunt severity-driven remediation with a four-factor risk model built around internet exposure, known exploitation, automatability and system control.
AI, Ancient Bugs, Fresh Exploits, and an Overflowing Patch Queue
A trio of fresh flaws highlights the heightened vulnerability of the entire enterprise software stack, as the combination of automated scanning, the availability of exploit code, and patching delays is cited as a factor in the rise of vulnerability exploitation as a preferred entry point.
Highlights from CYBR.HAK.CON. 2026
Among the topics: Cognitive warfare and medical device mayhem.
AI Scanning's Hidden Tax: $128K in Triage Before a Fix
AI security scanners promise to reduce AppSec workload, but Contrast Labs' testing shows they systematically multiply it, turning a $315 API fee into an estimated $128,000 triage burden, before fixing a single vulnerability.
Cognitive Warfare Has Entered the SOC. What it is, How to Respond
Information overload, cognitive warfare, and nonstop digital noise are turning human attention into a vulnerable attack surface.
Pentesting Theater: When the Pentest Report Lands, and the Vulnerabilities Remain
Organizations spend real money on penetration testing and too often walk away afterwards with the same vulnerabilities they started with. The test happened. The report landed. The checkbox got checked. Nothing significant has changed.
The Vulnpocalypse Isn’t Your Problem
But it might be your company’s problem.
From Threat Intel to ‘VulnOps’: Why Level 1 SOC as We Know It Is Heading to Extinction
Traditional security operations: CTI feeds piped into a SIEM, alerts routing into a ticket queue, and analysts triaging the resulting flood is running out of road. A new operational model is emerging in its place, and it doesn’t look much like what most security teams currently have in place.
How to Build a Vulnerability Intelligence Pipeline That Doesn't Rely on NIST's NVD
With NIST's National Vulnerability Database now triaging only a fraction of incoming CVEs, security teams must diversify beyond NVD while rethinking patch SLAs and risk scoring.
NIST Declares “Inbox Zero,” Pulls Back on CVE Enrichment. Now Enterprise Security Teams Must Fill the Gap
An analysis of the National Vulnerability Database's shift to risk-based triage and what it actually means for the people patching systems (first of a two-part analysis)