Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In late February of this year, Change Healthcare experienced a massive ransomware attack. The company, a subsidiary of United Healthcare, is the largest clearinghouse for insurance billing and payments in the U.S, processing 15 billion medical claims each year.

‍Determining and disclosing impactful events has been a longstanding practice for organizations operating within the US market. As early as 1933, with the Securities Act, publicly traded businesses were required to disclose “material information” regarding their security environment, allowing shareholders to make more informed investment decisions.

Cyber security reports are an invaluable tool for keeping stakeholders and senior management informed about your cyber security efforts. This post outlines examples of some of the most popular reporting styles, with a particular focus on a field of cybersecurity drawing increasing interest among executive teams - Vendor Risk Management. Each of the cyber security report examples in this list have been pulled from the UpGuard platform.

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) is an important legislation that outlines how critical infrastructure sectors should deal with cybersecurity threats. CIRCIA strengthens cyber defenses by establishing comprehensive reporting requirements for cyber incidents and ransomware payments.

Cybersecurity is a critical concern for organizations of all sizes. Implementing robust security measures is a best practice and essential to protect against increasingly sophisticated cyber threats. However, the challenge is often more significant for small and medium enterprises (SMEs) due to limited resources, lack of security expertise, and other common obstacles.

As I mentioned at the beginning of this year, I am trying to do a monthly blog post on what might be termed “Major Security Events”. In particular this year, I’ve written about the Ivanti meltdown, Lockbit ransomware, and the xz backdoor. These events usually emerge cacophonously and suddenly into the cybersecurity landscape, and generally get everyone’s attention “real quick”.

AI risk and security management is unsurprisingly Gartner’s number one strategic technology trend for 2024. But you might be less familiar with number two: Continuous Threat Exposure Management (CTEM). Coined by Gartner in 2022, CTEM isn’t just another buzzy acronym – it’s a powerful process that can help continuously manage cyber hygiene and risk across your online environment.

Bitsight excels at using externally available data to paint a detailed picture of organizations’ digital footprint, including assets, organizational hierarchy, third-party relationships, and risk posture. But as more IT resources shift to cloud service providers, gaining complete and precise visibility into your external attack surface becomes increasingly complex.

In March 2022, when the not-so-new-anymore SEC cybersecurity regulations were initially drafted, some argued that smaller reporting companies, defined by having a public float of less than $250 million or an annual revenue of less than $100 million, should be exempt, given the "outsized costs" they faced. Others proposed that these smaller organizations should have a longer disclosure deadline, helping to alleviate the chances of non-compliance.