Organizations are adopting AI tools quickly, but many CISOs lack clear processes to manage the risks.

Data Exposure Concerns
Most AI chatbots are closed source, meaning security teams cannot see how data is handled.

Employees often feed sensitive information into these systems without understanding the potential exposure.

High-profile incidents, like Samsung employees entering proprietary code into ChatGPT, highlight the danger.

Gaps in Governance
Surveys show 60% of CISOs consider AI vendors uniquely risky, yet only 22% have formal policies for vetting these tools.

General third-party onboarding processes are being applied to AI, which fails to account for its unpredictable behavior.

Limited Visibility
Only 17% of organizations claim full insight into third-party AI risks. Larger companies are slightly better, but smaller organizations are often unprepared.

Balancing Innovation and Security
CISOs face a delicate balance: enabling productivity with AI while protecting sensitive data through stronger vetting and oversight.

Key Takeaway
Proper AI governance is now a key part of managing modern enterprise security.

The European Commission is stepping up efforts to protect critical IT systems from cyber and hybrid attacks.

High-Risk Supplier Focus

New rules aim to reduce risks from suppliers outside the EU, especially for mobile networks and other essential infrastructure.

Faster Testing and Easier Compliance

An updated European Cybersecurity Certification Framework will speed up security testing and simplify compliance, easing the load for smaller businesses.

Stronger EU Cyber Agency

ENISA, the EU’s cybersecurity agency, will get a bigger role in threat analysis, incident response, vulnerability management, and coordination across member states.

Implementation Timeline

The package must be approved by the European Parliament and the EU Council. Once approved, EU countries have one year to apply the rules nationally.

These steps are designed to make the EU’s IT ecosystem safer and more resilient against growing cyber threats.

Joe Nocera talks about resilience in business and society.
He explains that true resilience is not a short fix, but something that must be discussed and built over a long time.

He points out that many people want to move past hard events quickly, like the pandemic, without unpacking what happened.

Nocera suggests that not talking about the real lessons of hard times makes groups less ready for future problems.

He discusses how resilience includes looking at mistakes and how decisions were made during crises.

Instead of just hoping for stability, he promotes open talk and reflection as necessary parts of resilience.

Part of the talk focuses on how leaders, teams, and workers all need to keep up these conversations.

Resilience isn’t just an individual trait — it’s also how groups adjust, plan, and support each other.

Being resilient is not about one big fix.

It is about steady effort, honest talk, and ongoing learning from what did and didn’t work.

Cybersecurity challenges often go beyond technology. Firewalls, SIEMs, and new tools aren’t the root problem.

The real issues come from human behavior and unspoken rules that shape how security is applied day-to-day.

Layers of Culture

Culture in security has three layers: observable, non-observable, and implicit.

Observable culture includes policies, procedures, training, and visible actions like password use and device management. Organizations often focus here, but it only shows part of the picture.

Non-Observable and Implicit Culture

Non-observable culture covers habits and routines that aren’t written down.

Implicit culture includes beliefs, attitudes, and unwritten rules, like assuming security slows work and finding ways around it.

Ignoring these layers can undermine even the best security strategy.

Why It Matters

A firm with strong policies and technology can still fail if the culture encourages unsafe behaviors.

Leaders need to assess all layers of culture to ensure security practices are followed consistently.

Concluding Thought

Strong technology alone won’t protect an organization. Security culture, visible and hidden, drives how effective defenses really are.

A recent ransomware attack on a U.S. company allowed data recovery for 12 organizations.

Poor operational security by the attackers exposed sensitive data, giving victims a chance to restore their systems without paying.

How the Error Happened

Attackers often demand payment in exchange for data. In this case, the criminals left weaknesses in how they handled encrypted files and backups.

These gaps made it possible for cybersecurity teams to recover critical files safely.

Lessons for Organizations

Even when facing ransomware, careful preparation pays off.

Regular backups, testing recovery procedures, and monitoring for unusual activity can reduce the impact of attacks and help avoid paying ransom.

Concluding Thought

Ransomware is a serious threat, but mistakes by attackers and strong security practices can allow organizations to regain control and protect their information.

Cybercriminals are using artificial intelligence to craft phishing attacks aimed at energy companies.

These attacks are designed to trick employees into revealing credentials or clicking harmful links.

How the Attacks Work

The attackers exploit SharePoint and other collaboration tools to appear legitimate.

By mimicking internal communications, they make employees believe the messages are safe, increasing the chances of compromise.

Risks for Organizations

Even small mistakes can give attackers access to sensitive systems.

Security teams are urged to train staff regularly, monitor unusual account activity, and implement multi-factor authentication to reduce risks.

Concluding Thought

The combination of AI and familiar workplace tools makes phishing more convincing.

Staying alert and using layered security measures helps protect critical energy infrastructure.