Chris Forbes

CISA pledges robust support for funding, further development of CVE program A key official from the agency said the vulnerability management program will continue with additional participation and enhancements

3

1 Comment

The U.S. NIST (National Institute of Standards and Technology) has released the second public draft of the NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide. This follows the initial public draft of NIST SP 1308 published in March. The updated draft incorporates significant revisions based on stakeholder feedback. NIST is now reopening the document for public comment, with submissions accepted until January 7 of next year. The CSF 2.0 Quick-Start Guide is part of a series of guides released since February 26, 2024, aimed at providing tailored pathways for different audiences to adopt and operationalize the Framework more effectively. The NIST CSF 2.0 guides assist organizations in managing cybersecurity risks by helping them understand, assess, prioritize, and communicate consistently about their cybersecurity efforts, including those related to the cybersecurity workforce. The Quick-Start Guide integrates concepts from enterprise risk management, cybersecurity risk management, and workforce management, enabling organizations to enhance communication around cyber risk and make informed workforce decisions that align with actual risk conditions and planned responses. #NIST #RISKMANAGEMENT #ERM #CYBERSECURITY #OPERATIONALRESILIENCE #OPERATIONALRISK #WORKFORCE #FRAMEWORK #GUIDE

4

Artificial Intelligence — The Problem, The Solution, or Both? Last week, I had the privilege of speaking as a panelist at the 3rd ACFE National Fraud Conference 2025. The discussion was dynamic, thought‑provoking, and centered on one of the most pressing questions facing our industry today: Is Artificial Intelligence (AI) the problem, the solution, or both? AI as the Solution On the upside, AI offers capabilities that were unimaginable a decade ago. Machine learning models can process vast amounts of data in real time, spotting anomalies and predicting fraud patterns faster than any human team. For organizations battling increasingly sophisticated fraud schemes, this is a game‑changer. Instead of relying on outdated, rule‑based systems that react after damage is done, AI enables proactive defense. It learns, adapts, and evolves. It can flag suspicious activity before risks materialize, giving businesses the chance to act decisively. In a world where trust is currency, AI helps organizations protect both their bottom line and their reputation. AI as the Problem But here’s the catch: the same technology that empowers defenders also arms attackers. Generative AI has made it easier than ever to create convincing phishing emails, deepfakes, and synthetic identities. Automated attacks can exploit vulnerabilities at a speed and scale we’ve never seen before. In other words, AI doesn’t just level the playing field—it raises the stakes. Fraudsters are no longer limited by human capacity; they can weaponize AI to launch attacks that are faster, smarter, and harder to detect. This duality means we’re not just fighting fraud—we’re fighting AI‑powered fraud. Finding the Balance So where does that leave us? For CISOs, Fraud Risk leaders, and anyone responsible for safeguarding digital ecosystems, the challenge is clear: leverage AI responsibly while mitigating its unintended consequences. That requires three things: Robust governance frameworks: Clear policies and ethical guidelines for AI deployment are non‑negotiable. Transparency and accountability must be built into every system. Continuous monitoring: AI is powerful, but it’s not perfect. Biases, blind spots, and vulnerabilities can creep in. Regular audits and monitoring are essential to keep systems trustworthy. Collaboration across industries: Cyber threats don’t respect borders or sectors. Sharing intelligence and best practices across industries strengthens collective defenses. A united front is far more effective than isolated efforts.   Final Thought AI is neither purely the problem nor solely the solution—it’s both. The organizations that succeed will be those that recognize this duality and act decisively. Embracing AI with responsibility, foresight, and collaboration is the only way forward. The question isn’t whether AI will shape the future of fraud prevention and cybersecurity—it already is. The real question is: Will we rise to the challenge of using it wisely?

57

2 Comments

ℹ️ Most boards approve technology budgets. Few boards understand what they approve. That’s not a criticism. It’s a structural issue that has existed for years. But with technology accelerating fast, it has become a real risk. and a potential liability. Boards approve technology budgets, AI strategies, and cybersecurity frameworks. But approval without understanding is not governance. It is hope dressed up as oversight. ℹ️ A board does not need to write code. But it must be able to challenge the risk model. ⚠️ If you cannot challenge the risk model, you cannot govern it. Research continues to highlight a capability gap at board level in cyber oversight. Now add AI. Many boards approve AI deployments without being able to assess risk, bias, controls, and liability in business terms. What I see repeatedly in boardrooms: 🔹One “tech-savvy” director carries the entire technology and AI agenda alone. That is not oversight. 🔹AI, cybersecurity, data governance, and data protection are treated as separate topics. They are not. An AI system is only as secure as the data, access, and controls behind it. 🔹Risk is approved without being understood. Regulation is raising the bar (e.g., NIS2, the EU AI Act, FINMA expectations). Technology governance is becoming more explicit — and the downside is real. 💡 Here is what concerns me most: At board events, many board member and executives agree this gap exists. Back at the office, not much changes. The reasons are familiar: “other priorities”, “we are too small”, “it takes too much time”, “it’s too expensive”. 👉 In the short term, that can work, with a bit of luck. In the long term, it becomes governance debt. And governance debt always comes due. ❓ What is your experience; does your board have genuine technology oversight, or is it performed oversight? ✴️ I help and support organisations and boards in building effective technology governance, so cyber and AI risk is translated into decisions the board can actually understand, challenge, and own. #BoardGovernance #TechnologyGovernance #CyberRisk #AIGovernance #RiskManagement #DataGovernance

7