Omar Khawaja

The intersection of #security and #fraud: Excited to join the #CISO Spring Tour with Team8 on behalf of Charm Security, meeting security leaders across Atlanta, DC, and NYC to discuss the intersection of security, fraud, and human vulnerabilities. As #scams and #social_engineering threats continue to evolve, the lines between cybersecurity and fraud prevention are blurring. Organizations are realizing that protecting their customers and workforce from deception and manipulation is a security imperative. One key takeaway from these discussions: The human element remains the biggest challenge, as attackers exploit trust, urgency, and authority at scale. The need for AI-driven defenses that understand and counter human vulnerabilities is becoming clear. Looking forward to more conversations on how security and fraud teams can adapt to this shift.

85

1 Comment

Is Cyber Risk on the Rise? Next week, I'm doing a webcast for the RSA Conference to explore that question using 15 years of data on security incidents and losses. It draws from the upcoming 2025 Information Risk Insights Study (IRIS) from Cyentia Institute. Details and registration link below. Summary: Is cyber risk truly skyrocketing, as many believe? Are organizations more prone to breaches now than they were 10 years ago? Have the financial impacts of security incidents increased or decreased over time? Are these trends similar across organizations of all types and sizes? We’ll answer these questions together by analyzing a huge historical dataset of cyber events and losses. #cyberrisk #cyberresilience #cybersecurity March 26, 2025 | 10:00 AM PT | 1:00 PM ET Register: https://lnkd.in/ep3GKQ5w

46

6 Comments

Last night, I had the privilege of moderating a fireside chat with Deputy Assistant Secretary of State Gharun Lacy a leader shaping how the U.S. approaches cybersecurity on the global stage. His perspective is both rare and deeply grounded in operational reality. A few takeaways that stood out for those who may have missed it: Cyber is geopolitical. Today’s threats target influence, trust, and stability, and amplified and scaled through technology. Defenders must think beyond technical controls and understand adversary intent. Risk is accelerating. AI, hybrid operations, and global tension are reshaping the threat landscape. Resilience is no longer static. It must be adaptive and intelligence-informed. This was a huge theme for the conversation. The attack surface is multi-domain. Cybersecurity cannot be siloed. Digital, physical, and hybrid threats require coordinated, cross-sector defense. Mr. Lacy commented on how we can be myopically focused through the lense of our roles. We need to step back to see the larger picture. Intelligence enables precision. With infinite threats and finite resources, intelligence-led security allows leaders to focus where it matters most. This is near and dear to my heart as former threat intelligence leader who has seen the industry lose its faith in intelligence. If you’re responsible for protecting systems, shaping policy, or leading teams, this is the operating environment we’re in now. My sincere thanks to Deputy Assistant Secretary Gharun Lacy for his leadership, candor, and service. Conversations like this help prepare defenders for what’s ahead. SANS Institute Rob T. Lee

122

4 Comments

🚨 The regulatory chaos in cybersecurity is staggering: 45 different incident reporting requirements across 22 federal agencies, with 49-79% of parameters in direct conflict. We need urgent reform and CISA modernization for today's AI-enabled threat landscape. My thoughts in @TechNewsWorld 👇 https://bit.ly/45V77km #Cybersecurity #CISA #RegulatoryReform #AIThreats

20

1 Comment

Cybersecurity is a Whole-of-Nation Challenge — And States Can’t Go It Alone This week’s Congressional hearing made one thing crystal clear: the State and Local Cybersecurity Grant Program (SLCGP) isn’t just a budget line—it’s a frontline defense. Experts like Utah’s Alan Fuller and Connecticut’s Mark Raymond didn’t mince words: SLCGP is a cost-effective engine for cyber readiness, enabling under-resourced municipalities to protect the systems we all rely on—water, healthcare, public safety. In a threat landscape where ransomware attacks doubled between 2018 and 2024, this program isn’t optional. It’s operationally essential. But the message wasn’t just about money—it was about mission. This grant enables a “whole-of-state” model that unites state and local actors, sharing intelligence and establishing clear cyber roles before—not after—incidents happen. Let’s not lose the plot in budget debates. Preventing a breach is cheaper, safer, and smarter than recovering from one. Investing upstream in cyber hygiene, training, and detection is national security, not just local spending. Read more at: https://lnkd.in/e-95QDFV

27

1 Comment

2025 State of Cyber Risk Management Report | FAIR Institute After months of research and analysis, I’m excited to share our FAIR Institute report on the State of #Cyber Risk Management (CRM). Unlike many "state of" reports that try to gauge overall maturity in the industry, we instead focused on those with established programs to see what's working, what challenges they're facing, and the benefits they're getting from CRM. Based on responses from 402 cyber professionals globally, our data revealed the following: ✅ CRM is delivering tangible results, including cyber-business alignment, optimized cyber investments, risk reduction (of course!) ✅ Cyber risk quantification (#CRQ) is used by about a third as their primary method of CRM ✅ Nearly all were familiar with #FAIR, and nearly half were either using FAIR or planning to use it; 90% of those using FAIR are seeing success with it ✅ Most were also quantifying third-party risk and a majority have tightly integrated CRM with #TPRM. ✅ Automation is extensively used to scale CRM programs ✅ AI is also actively used by nearly half, and not just in their labs ✅ CRM teams are consuming a surprisingly wide variety of data to do their jobs (top sources: endpoint security, cyber threat intel, compliance audit results, #SIEM, VA, IR records) ✅ Internal demand for CRM is rising, and increasing demand correlates with CRM maturity (more mature, higher demand expected) Of course, CRM teams face many challenges. The biggest ones were people-related (exec commitment, poor comms between departments, peer resistance). Technical and data-related challenges were cited the least, and even skills and resources were down the list. (Hopefully, our training 10K professionals over the years has helped!) Download the report here: https://lnkd.in/e8ihkFTB Please use the data to support your own programs. I’d love to hear your reactions: What stands out to you? Are there questions you have that you'd like to see answered with this or future research? Thanks to our many members who reviewed and contributed to the report and to our sponsors, GuidePoint Security and Safe Security. #CyberRisk #CRQ #FAIR #CyberSecurity #RiskManagement #AIRisk

84

6 Comments