Technical Resources

Video Tutorials

Why is ISACA involved in CMMC? This clip explains how the CMMC ecosystem is scaling trained and certified professionals to support Level 2 assessments across the Defense Industrial Base. Get the free CMMC ebook: https://www.infosecinstitute.com/form/cmmc-ebook/?utm_source=youtube&utm_medium=video&utm_campaign=cmmc #CMMC #Cybersecurity #ISACA
Why ISACA Is Involved in CMMC
Get your free CMMC ebook: https://www.infosecinstitute.com/form/cmmc-ebook/?utm_source=youtube&utm_medium=video&utm_campaign=cmmc The Cybersecurity Maturity Model Certification (CMMC) program is evolving, and organizations across the Defense Industrial Base need qualified professionals to support implementation and assessments. In this webinar, recorded on May 19, 2026, Infosec sits down with Todd Gagnon, Director of the CMMC Assessor and Instructor Certification Organization (CAICO) at ISACA, to discuss what these changes mean for current and aspiring CMMC professionals. Learn how ISACA's role as the CAICO impacts the CMMC ecosystem, certification pathways and opportunities for those pursuing the CMMC Certified Professional (CCP) and CMMC Certified Assessor (CCA) credentials. Whether you're preparing for a CMMC certification, supporting compliance initiatives or looking to advance your cybersecurity career, this discussion provides valuable insights into the future of the CMMC program. In this session, you'll discover: 0:00 — Intro and CMMC resources 1:08 — What CMMC protects 2:59 — CMMC levels 1, 2 and 3 6:11 — Why CMMC matters 8:59 — CMMC timeline and phases 10:51 — Flow-down requirements 12:50 — ISACA’s CAICO role 14:24 — CMMC ecosystem players 17:30 — What C3PAOs do 19:28 — In-house vs. third-party CMMC support 22:16 — CMMC beyond defense contracts 23:28 — CCP certification overview 25:52 — CCA certification overview 28:09 — Lead CCA requirements 29:42 — CMMC instructor role 30:54 — CMMC training providers 31:42 — CCP and CCA exams 34:12 — Maintaining CMMC credentials 37:47 — Q&A: U.S. citizenship requirement 39:28 — Q&A: Best cert for beginners 40:40 — Q&A: CCP and CCA timeline 42:05 — Q&A: Becoming a Lead CCA 43:14 — Q&A: Sponsoring organization 44:11 — Q&A: Exam prep and study guides 45:21 — Q&A: CMMC career demand 46:21 — Closing and next steps Learn more about CMMC training and certification opportunities with Infosec. — Free CMMC ebook: https://www.infosecinstitute.com/form/cmmc-ebook/?utm_source=youtube&utm_medium=video&utm_campaign=cmmc — CMMC CCP training: https://www.infosecinstitute.com/courses/cmmc-certified-professional-boot-camp/?utm_source=youtube&utm_medium=video&utm_campaign=cmmc — CMMC CCA training: https://www.infosecinstitute.com/courses/cmmc-certified-assessor-boot-camp/?utm_source=youtube&utm_medium=video&utm_campaign=cmmc About Infosec Infosec Institute makes cyber workforce readiness a reality. Through role-based training that spans certification boot camps, skills development, security awareness and human risk management, we develop the capabilities your entire workforce needs to stay ahead of today's threats. The result: SOC analysts defending the perimeter, security engineers building secure systems and front-desk employees spotting advanced phishing attempts. 70% of the Fortune 500 have trusted Infosec for more than two decades. Learn more at infosecinstitute.com.
CMMC Is Changing: What ISACA's New CAICO Role Means for CCP & CCA Candidates
Can you spot the vishing attempt before the reveal? This social engineering test from Infosec HRM uses urgency, supplier payment changes and pressure to bypass approval. Watch the full webinar here: https://www.youtube.com/watch?v=UFVodmhkWvk ABOUT INFOSEC Infosec Institute makes cyber workforce readiness a reality. Through role-based training that spans certification boot camps, skills development, security awareness and human risk management, we develop the capabilities your entire workforce needs to stay ahead of today's threats. The result: SOC analysts defending the perimeter, security engineers building secure systems and front-desk employees spotting advanced phishing attempts. 70% of the Fortune 500 have trusted Infosec for more than two decades. Learn more at infosecinstitute.com.
Can You Spot the AI Vishing Attempt?
Thinking about earning your next cybersecurity certification? Hear directly from professionals who transformed their careers through Infosec Boot Camps. From Security+ and CISM to Ethical Hacking and beyond, these students share how expert instructors, hands-on training, Exam Pass Guarantee support and immersive learning experiences helped them build confidence, pass certification exams and unlock new career opportunities. Whether you're preparing for your first cybersecurity certification or advancing your skills to the next level, discover why thousands of professionals trust Infosec Boot Camps to accelerate their careers. ✅ Expert-led live training ✅ Hands-on learning experiences ✅ Exam Pass Guarantee ✅ Industry-recognized certifications ✅ Career advancement opportunities Learn more about Infosec Boot Camps and start your certification journey today: #Cybersecurity #CybersecurityTraining #SecurityPlus #CompTIASecurityPlus #EthicalHacking #CISM #CybersecurityCertification #Infosec #InfosecInstitute #CyberCareer #ITTraining #CertificationTraining #CareerGrowth #InformationSecurity #cyberskills About Infosec Infosec’s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ’s security awareness training. Learn more at infosecinstitute.com.
Infosec Boot Camps: Real learners on getting certified and job-ready
AI, Social Engineering & the Future of Human Risk Management | Infosec HRM Webinar Security awareness training is entering a new era—driven by rapid advances in AI, agentic models, and increasingly sophisticated social engineering attacks. In this Infosec Institute session, senior leaders explore how organizations must rethink human risk in a world where voice cloning, deepfakes, and multi-channel attacks can be created in minutes. Hosted by Cody Grant (Senior PMM, Infosec Institute), this discussion brings together cybersecurity experts to break down how AI is collapsing “time to action” for both attackers and defenders—and why traditional assumptions like “our people know better” no longer hold up in today’s threat landscape. The session includes: - Real-world examples of AI-powered phishing and vishing attacks - Insights into how agentic AI is reshaping cyber threats - Strategies for modern security awareness and human risk programs - How organizations can measure real behavioral risk vs. training completion rates - Practical steps to strengthen identity verification and employee resilience As AI-driven attacks become faster, cheaper, and more convincing, organizations must evolve from awareness training alone to behavior-driven security programs that adapt in real time. 📌 Free eBook of HRM case studies: https://www.infosecinstitute.com/form/human-risk-management-case-studies/?utm_source=youtube&utm_medium=webinar&utm_campaign=hrmwebinar 📌 Learn more about Infosec HRM: https://www.infosecinstitute.com/iq/human-risk-management/?utm_source=youtube&utm_medium=webinar&utm_campaign=hrmwebinar 📌 Book a custom Infosec HRM demo: https://www.infosecinstitute.com/form/demo-infosec-hrm/?utm_source=youtube&utm_medium=webinar&utm_campaign=hrmwebinar #Cybersecurity #HumanRiskManagement #SecurityAwareness #AIinCybersecurity #Phishing #Vishing #Deepfakes #SocialEngineering #Infosec #InformationSecurity #CyberDefense About Infosec Infosec’s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ’s security awareness training. Learn more at infosecinstitute.com.
AI, Social Engineering & the Future of Human Risk Management | Infosec HRM Webinar
We're in Philadelphia this week at NiCE Conference & Expo, connecting with cybersecurity leaders, educators and practitioners who are helping shape the future of the workforce. The conversation this year is bigger than cybersecurity skills alone. If you're attending, stop by and meet the team; we'd still love to connect and learn more about your organization's cybersecurity and workforce development goals. 🛡️ See you soon! 📍 #NICE2026 #Cybersecurity #CyberWorkforce #SecurityAwareness #CyberTraining #Upskilling #AISecurity #InfosecInstitute About Infosec Infosec’s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ’s security awareness training. Learn more at infosecinstitute.com.
Infosec Institute | NICE Conference 2026! 🚀
AI Security: Needs Speed AND Relevance | CompTIA SecAI+
AI Skills Trifecta | CompTIA SecAI+
Great conversations and even better insights came out of ISACA North America 2026. 🔐 From discussions around agentic AI and evolving threat landscapes to the growing need for stronger cyber resilience, it was clear that organizations are actively looking for ways to stay ahead while managing risk responsibly. Events like ISACA are always a great reminder of how collaborative and fast-moving the cybersecurity community is. (📸: @Kacie | @Iva) #ISACA #Cybersecurity #AI #Governance #RiskManagement #Infosec #SecurityAwareness #AIGovernance #CyberRisk About Infosec Infosec’s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ’s security awareness training. Learn more at infosecinstitute.com.
Recap: ISACA 2026 | Iva Amos and Kacie Schwartz
Subscribe
In this video, we discuss and demonstrate the Manager of Managers (MoM), a feature in Security Onion Pro that we introduced in version 2.4.150. The Manager of Managers allows for a single console to remotely connect to and interact with the data in one or more independent subgrids. Perfect for MSSPs, parent organizations managing subsidiary security teams, and more! If you'd like more information about Security Onion Pro, check out our website at https://securityonion.com/pro If you have questions or problems with your Security Onion deployment, please start a new discussion at https://securityonion.net/discuss If you have words of encouragement for the Security Onion team, please feel free to comment below.
Security Onion Pro: Manager of Managers
In this session, Matt Gracie introduces Security Onion 2.4.190. If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Introduction
In this video, we discuss and demonstrate the Onion AI Assistant, a popular feature in Security Onion Pro that we introduced in version 2.4.190. The Onion AI Assistant can gather context, dig through logs, generate timelines, and otherwise act as a tremendous aid to your analysts during an investigation. If you'd like more information about Security Onion Pro, check out our website at https://securityonion.com/pro If you have questions or problems with your Security Onion deployment, please start a new discussion at https://securityonion.net/discuss If you have words of encouragement for the Security Onion team, please feel free to comment below.
Security Onion Pro: Onion AI Assistant
In this session, Matt Gracie downloads and checks the ISO in preparation for installing Security Onion 2.4.190. If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Installation Part One
In this session, Matt Gracie completes the installation and setup of Security Onion 2.4.190. If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Installation Part Two
In this session, Matt Gracie demonstrates how to update Security Onion to the latest version in either a traditional or airgap deployment. If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Updating Security Onion
In this session, Matt Gracie introduces the Alerts and Cases tools in Security Onion, demonstrating how to pivot between datasets to investigate an alert and track the investigation in our case management tool. If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Alert Triage and Case Creation
In this session, Matt Gracie introduces the analyst tools built into Security Onion 2.4.190, including Alerts, Hunt, Dashboards, and more! If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Introduction to Analyst Tools
In this session, Matt Gracie demonstrates ad-hoc threat hunting in Security Onion using the Hunt and Dashboards tools. If you have words of encouragement for the Security Onion team, please comment below. Don't forget to like and subscribe! If you have questions or problems, please start a new discussion at https://securityonion.net/discuss. For more training, please see https://securityonion.com/training. For enterprise features, check out Security Onion Pro at https://securityonion.com/pro. For hardware appliances, please see https://securityonion.com/hardware.
Security Onion Essentials 2026 – Threat Hunting
Subscribe
Please enjoy this encore of Hacking Humans. This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://www.linkedin.com/in/dave-bittner-27231a4/)  ⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠ (https://www.linkedin.com/in/dave-bittner-27231a4/) , ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://www.linkedin.com/in/joecarrigan/) , and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://www.linkedin.com/in/varmazis/)  (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://space.n2k.com/podcasts/t-minus?__hstc=223811332.a636bba53840b4700c929fe67723a129.1721054632698.1747145009569.1747159962459.413&__hssc=223811332.2.1747159962459&__hsfp=3690629108)  Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We've got some follow-up from listener Kajetan, who recalled a run-in with a scammer in Paris posing as a mute fundraiser—and says he performed a "miracle" by crossing out his name, prompting the supposedly mute woman to suddenly start yelling at him. Maria has the story on how small businesses in Toronto, like the family-run Souvlaki Hut and Pippins Tea Company, were shocked to discover that thieves exploited vulnerabilities in their point of sale terminals to issue themselves thousands in fraudulent refunds—exposing serious flaws in how these machines are secured. Dave's story is on a Stanford-led study that found popular AI therapy bots, including ChatGPT and commercial mental health platforms, often respond inappropriately to serious mental health issues—fueling delusions, validating harmful thoughts, and failing to follow basic therapeutic guidelines—raising urgent concerns about their use as replacements for human therapists. Joe follows the story on a sweeping federal investigation into Minnesota's Housing Stabilization Services program, where agents raided homes and businesses tied to an alleged multi-million-dollar Medicaid fraud scheme that exploited vulnerable residents and billed taxpayers for housing support services that were never provided. Our catch of the day is on a patient scammer who spent five months building trust before claiming to send a $700K inheritance payout locked in a lawsuit—complete with a fake video of a safe and a shady tracking number—only to demand €15,000 in "customs fees," a scam the Redditor thankfully saw through before handing over any money. Complete our annual ⁠⁠⁠⁠audience survey⁠⁠⁠ (https://www.surveymonkey.com/r/JD7JFL2) ⁠ before August 31. Resources and links to stories: • ⁠⁠AI therapy bots fuel delusions and give dangerous advice, Stanford study finds⁠ (https://arstechnica.com/ai/2025/07/ai-therapy-bots-fuel-delusions-and-give-dangerous-advice-stanford-study-finds/) • ⁠‘It was a shock’: Toronto business owner says customer used point of sale terminal to issue himself $2,000 refund⁠ (https://www.ctvnews.ca/toronto/article/it-was-a-shock-toronto-business-owner-says-customer-used-point-of-sale-terminal-to-issue-himself-2000-refund/) • ⁠KARE 11 Investigates: Federal agents raid homes & businesses seizing evidence in housing fraud investigation⁠ (https://www.kare11.com/article/news/investigations/kare-11-investigates-federal-agents-raid-homes-businesses-housing-fraud-investigation/89-3d56042b-ce46-414b-b004-76f1a16bebf0) ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://therecord.media/fin6-recruitment-scam-malware-campaign) ⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://therecord.media/fin6-recruitment-scam-malware-campaign) ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (mailto:hackinghumans@n2k.com) .
The delusional side of AI therapy.
This week, Dave and Ben take a look at the Supreme Court's recent ruling that has significantly changed how the law enforcement must approach collecting user location data. Alongside this conversation, Ben also sits down with former Congressman and current President of Americans for Responsible Innovation (https://ari.us/) (ARI) Brad Carson (https://www.linkedin.com/in/brad-carson-82b8a253) to talk about how US/China trade relations could shape the future of AI development. While this show covers legal topics, and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney.  Links to today's stories: • Supreme Court says police need a warrant to obtain Google location data. (https://www.washingtonpost.com/politics/2026/06/29/police-need-warrant-get-detailed-smartphone-location-data-justices-rule/) Get the weekly Caveat Briefing delivered to your inbox. Like what you heard? Be sure to check out and subscribe to our ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Caveat Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thecyberwire.com/newsletters/caveat-briefing) , a weekly newsletter available exclusively to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K Pro⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thecyberwire.com/pro)  members on ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K CyberWire's⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thecyberwire.com/)  website. N2K Pro members receive our Thursday wrap-up covering the latest in privacy, policy, and research news, including incidents, techniques, compliance, trends, and more. This week's Caveat Briefing ⁠⁠⁠⁠⁠examines (https://www.politico.com/news/2026/06/29/supreme-court-location-data-ruling-00979929) ⁠⁠ the Supreme Court's recent ruling which significantly undermined geofencing and granted Fourth Amendment protections for location history data. Curious about the details? Head over to the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Caveat Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thecyberwire.com/newsletters/caveat-briefing/4/10) for the full scoop and additional compelling stories. Got a question you'd like us to answer on our show? You can send your audio file to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠caveat@thecyberwire.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (mailto:caveat@thecyberwire.com) . Hope to hear from you. Learn more about your ad choices. Visit megaphone.fm/adchoices (https://megaphone.fm/adchoices)
Drawing a digital line for geofencing.
The US restores exports of Anthropic’s most advanced AI models. Adobe and Citrix rush out critical patches. RustDuck emerges as a fast-evolving DDoS threat. The Gentlemen raise the stakes with a new EDR-killing exploit. Rocket lab bets big on Iridium. Researchers unveil browser-only ransomware. New Zealand faces questions about its cyber readiness. Iran’s long-running cyber espionage campaign is back in the spotlight. Our guest is Donald Codling, CISO and senior advisor to REGO on cybersecurity and data privacy matters, to discuss the importance of tying security by design to psychological safety and digital trust. VIP backstage access, courtesy of Claude. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing (https://thecyberwire.com/newsletters/daily-briefing) , and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn (https://www.linkedin.com/company/10454826/admin/feed/posts/) . CyberWire Guest Today we are joined by Donald Codling (https://www.linkedin.com/in/don-codling-27255315/) , CISO and senior advisor to REGO (https://regopayments.com/) on cybersecurity and data privacy matters, to discuss the importance of tying security by design to psychological safety and digital trust. Selected Reading Fable and Mythos: Anthropic says US lifts export ban on its advanced AI tools (https://www.bbc.com/news/articles/cdr42623e1do) (BBC) Adobe patches seven max severity ColdFusion, Campaign flaws (https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/) (Bleeping Computer) RustDuck: The Botnet That's Still Small but Engineering Like It Plans to Grow (https://securityaffairs.com/194556/malware/rustduck-the-botnet-thats-still-small-but-engineering-like-it-plans-to-grow.html) (SecurityAffairs) Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack (https://www.securityweek.com/citrix-patches-netscaler-vulnerabilities-including-new-http-2-bomb-attack/) (SecurityWeek) Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs (https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/) (Expel) Rocket Lab to Acquire Iridium in Historic Deal, Creating A Fully Vertically Integrated Space Powerhouse Primed for Growth (https://www.globenewswire.com/news-release/2026/06/29/3318842/0/en/rocket-lab-to-acquire-iridium-in-historic-deal-creating-a-fully-vertically-integrated-space-powerhouse-primed-for-growth.html) (Globe Newswire) Ransomware that runs inside your browser tab, where antivirus cannot see it (https://suriq.io/blog/browser-only-ransomware-file-system-access) (Suriq) Three major cybe (https://www.rnz.co.nz/news/science-and-technology/650122/three-major-cyberattacks-have-raised-alarms-about-new-zealand-s-security) https://suriq.io/blog/browser-only-ransomware-file-system-accessrattacks have raised alarms about New Zealand's security (https://www.rnz.co.nz/news/science-and-technology/650122/three-major-cyberattacks-have-raised-alarms-about-new-zealand-s-security) (RNZ) Arrest of Iranian Hacker Spotlights Iran’s Movement into Economic Espionage and IP Theft (https://www.zetter-zeroday.com/arrest-of-iranian-hacker-spotlights-irans-movement-into-economic-espionage-and-ip-theft/) (Zero Day) Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival (https://www.wired.com/story/claude-helped-a-hacker-find-a-way-to-issue-tickets-to-almost-every-us-music-festival/) (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey (https://www.surveymonkey.com/r/NCFFCZJ) . Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com (http://sponsor.thecyberwire.com/) . The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices (https://megaphone.fm/adchoices)
The AI lock comes off.
The Supreme Court limits geofence warrants. DHS moves to expand CISA. The State Department offers $10 million for Russian hackers. A legal theory could reshape EU-U.S. data sharing. Plus, cyberattacks hit D.C. housing, Oracle and SimpleHelp flaws face active exploitation, malware lingers on Japanese military networks, and stolen Apple supplier data surfaces online. John Cannava, CIO at Ping Identity, discusses how identity threats don't go on holiday. The Secret Service dial down the risk on BYOD.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing (https://thecyberwire.com/newsletters/daily-briefing) , and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn (https://www.linkedin.com/company/10454826/admin/feed/posts/) . CyberWire Guest Today we are joined by John Cannava (https://www.linkedin.com/in/johncannava/) , CIO at Ping Identity (https://www.pingidentity.com/en.html) , as he discusses how identity threats don't go on holiday: how attackers take advantage of these high-traffic moments to blend in with normal user behavior, and what needs to change to better protect fans of major events like this summer's World Cup, and identity threats in travel at large. Selected Reading Supreme Court says police need a warrant to obtain Google location data (https://wapo.st/4g7Vw8j) (Washington Post) DHS Eyes 600 New Cybersecurity Hires, New Director for CISA (https://www.bankinfosecurity.com/dhs-eyes-600-new-cybersecurity-hires-new-director-for-cisa-a-32105) (BankInfo Security) US posts $10 million reward over Russian cyber campaign targeting Signal, WhatsApp (https://therecord.media/10million-reward-us-russian-hackers-unc4221-unc5792) (The Record) US Supreme Court just blew up EU-US Data Transfers (https://noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers) (NOYB) DC Housing Authority hit by cyberattack, website down (https://wjla.com/news/local/dc-housing-authority-systems-compromised-website-down-robert-white-washington-dcha) (WJLA) Exploitation of Recent Oracle E-Business Suite Vulnerability Begins (https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/) (SecurityWeek) USB drives carrying China-linked malware infected Japanese military networks for nearly a year (https://www.bitdefender.com/en-us/blog/hotforsecurity/usb-drives-carrying-china-linked-malware-infected-japanese-military-networks-for-nearly-a-year) (Bitdefender) A forged login key unlocks SimpleHelp servers, and a new stealer is raiding cloud and AI credentials (https://suriq.io/blog/simplehelp-auth-bypass-djinn-stealer) (SURIQ) Apple iPhone 18 Pro supplier list, parts and photos exposed in Tata data leak (https://www.reuters.com/business/media-telecom/apple-iphone-18-pro-supplier-list-parts-photos-exposed-tata-data-leak-2026-06-29/) (Reuters) Even the Secret Service won't use company-issued phones (https://www.theregister.com/security/2026/06/26/even-the-secret-service-wont-use-company-issued-phones/5263356) (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey (https://www.surveymonkey.com/r/NCFFCZJ) . Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com (http://sponsor.thecyberwire.com/) . The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices (https://megaphone.fm/adchoices)
The court draws a privacy line.
Please enjoy this encore of Word Notes. A credential demonstrating an individual's knowledge in the field of cybersecurity, usually obtained by passing an exam or series of exams.  CyberWire Glossary link: https://thecyberwire.com/glossary/certification Audio reference link: Bombal, D., 2022. Are certifications important in Cybersecurity? [Video]. YouTube. URL ⁠www.youtube.com/watch?v=Zdgf_Wr82rs⁠ (https://www.youtube.com/watch?v=Zdgf_Wr82rs) .
Certification (noun) [Word Notes]
Please enjoy this encore of Word Notes. A credential demonstrating an individual's knowledge in the field of cybersecurity, usually obtained by passing an exam or series of exams.  CyberWire Glossary link: https://thecyberwire.com/glossary/certification Audio reference link: Bombal, D., 2022. Are certifications important in Cybersecurity? [Video]. YouTube. URL ⁠www.youtube.com/watch?v=Zdgf_Wr82rs⁠ (https://www.youtube.com/watch?v=Zdgf_Wr82rs) . Learn more about your ad choices. Visit megaphone.fm/adchoices (https://megaphone.fm/adchoices)
Certification (noun)
The White House keeps frontier AI models on a short leash. Russian threat actors increasingly target secure messaging platforms. DirtyClone is a high-severity Linux kernel privilege escalation flaw. An investigation claims federal websites are violating privacy rules. Microsoft dismantles a sophisticated malicious browser extension campaign. Setting up a GitHub repository could trick AI coding agents into executing malicious payloads. The DOJ shuts down illegal World Cup streamers. An Anonymous-linked hacker gets 18 months for website defacement. Monday business briefing. Dylan Sandlin, Program Manager for Digital and Cybersecurity Content at the National Association of Corporate Directors (NACD), discusses cyber risk as a board concern. In healthcare AI, patient privacy needs a second opinion. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing (https://thecyberwire.com/newsletters/daily-briefing) , and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn (https://www.linkedin.com/company/10454826/admin/feed/posts/) . CyberWire Guest Today we are joined by Dylan Sandlin (https://www.linkedin.com/in/dylan-sandlin-46672099/) , Program Manager for Digital and Cybersecurity Content at the National Association of Corporate Directors (https://www.linkedin.com/company/nacd-national-association-of-corporate-directors/) (NACD), discussing cyber risk as a board concern. If you're interested in learning more about NACD, be sure to check out their Director’s Handbook on Cyber-Risk Oversight (https://www.nacdonline.org/all-governance/governance-resources/governance-research/director-handbooks/2026-cyber-risk-oversight/) . Selected Reading Washington pushes AI into an export-control era as rivals rush to fill the gap (https://www.metacurity.com/washington-pushes-ai-into-an-export-control-era-as-rivals-rush-to-fill-the-gap/) (Metacurity) FBI and CISA Warn Russian Hackers Stealing Verification Codes and Account PINs From Signal Users (https://gbhackers.com/fbi-and-cisa-warn-russian-hackers-stealing-verification-codes/) (GB Hackers) 'DirtyClone' Linux Kernel Vulnerability Leads to Root Access (https://www.securityweek.com/dirtyclone-linux-kernel-vulnerability-leads-to-root-access/) (SecurityWeek) ‘It’s dangerous and it’s going to erode trust’: redesign of US government websites stokes surveillance fears | Trump administration (https://www.theguardian.com/us-news/2026/jun/28/government-website-visitor-tracking-surveillance-fears) (The Guardian) StegoAd: How 119 Fake Browser Extensions Stole Credentials and Ran Ad Fraud for Two Years (https://securityaffairs.com/194409/malware/stegoad-how-119-fake-browser-extensions-stole-credentials-and-ran-ad-fraud-for-two-years.html) (SecurityAffairs)  Clean GitHub repo tricks AI coding agents into running malware (https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/) (Bleeping Computer) US seizes hundreds of FIFA World Cup illegal streaming domains (https://www.bleepingcomputer.com/news/security/us-seizes-hundreds-of-fifa-world-cup-illegal-streaming-domains/) (Bleeping Computer) Anonymous-Linked Hacktivist Aubrey Cottle Jailed Over Texas GOP Cyberattack (https://hackread.com/anonymous-hacktivist-aubrey-cottle-gop-cyberattack/) (Hackread) Accenture acquires Dragos, runZero, and NetRise for more than $4 billion. (https://thecyberwire.com/newsletters/business-briefing/8/25) (N2K Pro Business Briefing) Medical diagnosis AIs can be tricked into telling whose data trained them (https://www.theregister.com/ai-and-ml/2026/06/24/medical-diagnosis-ais-can-be-tricked-into-telling-whose-data-trained-them/5261501) (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey (https://www.surveymonkey.com/r/NCFFCZJ) . Thank you for helping us continue to improve our show.   Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com (http://sponsor.thecyberwire.com/) . The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices (https://megaphone.fm/adchoices)
AI behind the velvet rope.
Despite the space sector seeing greater investment and attention year-over-year, the sector still remains bound by an outdated and ineffective supply chain, especially in the United States. In this week’s episode, host Maria Varmazis sits down with Doug Anderson (https://www.linkedin.com/in/douganderson/) , Partner at PwC (https://www.pwc.com/gx/en.html) , and Steve Jordan-Tomaszewski (https://www.linkedin.com/in/steve09/) , Vice President of the Space Systems Division at AIA (https://www.aia-aerospace.org/) , to dive into PwC’s recent study looking at the sector’s supply chain limitations. During the conversation, they examine the supply chain’s base risks and bottlenecks, and what strategies can be utilized to address these concerns. Key sources: • Strengthening America’s space supply chain (https://www.pwc.com/us/en/industries/industrial-products/library/strengthening-space-supply-chain.html) Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-space Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to space@n2k.com (mailto:space@n2k.com) ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2P T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K (https://www.n2k.com/) is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com. Learn more about your ad choices. Visit megaphone.fm/adchoices (https://megaphone.fm/adchoices)
Space supply chain pressures. [T-Minus: Space-Cyber Briefing]
In this Special Edition episode, N2K CyberWire's Dave Bittner sits down with Caitlin Sarian, widely known as Cybersecurity Girl, to explore how storytelling, authenticity, and community are reshaping a more human-centered cybersecurity landscape. Recorded live at The Cyber Guild's Uniting Women in Cyber (UWIC) Event last fall, this candid conversation highlights Caitlin’s unconventional path into cybersecurity and her mission to make the industry more accessible and relatable for all. Together, they explore how breaking down technical barriers can unlock new pathways into the field especially for those from nontraditional backgrounds. UWIC brings together industry leaders, practitioners, and emerging talent to advance the cybersecurity workforce through leadership, innovation, and inclusion. Host: Dave Bittner (https://www.linkedin.com/in/dave-bittner-27231a4/) Guest: Caitlin Sarian, Cybersecurity Girl - LinkedIn: https://www.linkedin.com/in/caitlin-sarian/ - Website: https://www.cybersecuritygirl.com/ The Cyber Guild: https://thecyberguild.org/ Uniting Women in Cyber Event: https://thecyberguild.org/uwic/
Uniting Women in Cyber: Cybersecurity Girl, Caitlin Sarian, on Breaking Barriers in Cybersecurity
Subscribe
Computer password inventor Fernando Corbato dies at 93, Serious Zoom security flaw could let websites hijack Mac cameras, Hackers' Operating System Kali Linux Released for Raspberry Pi 4, Over 1,300 Android Apps Caught Collecting Data Even If You Deny Permissions, and 25 Million Android Phones Infected With Malware That ‘Hides In WhatsApp’.
Cyber Security News Ending July 14 2019 – Android users be afraid, be very afraid. ransomware
Beware! Playing Untrusted Videos On VLC Player Could Hack Your Computer, U.S. Government Announces Critical Warning For Microsoft Windows Users, Florida city to pay $600K ransom to hacker who seized computer systems weeks ago, Confirmed: NASA Has Been Hacked and US 'launched cyber-attack on Iran weapons systems'.
Cyber Security News Ending June 23 2019 – Cyber War?
Microsoft says mandatory password changing is “ancient and obsolete”, Apple Just Patched a Modem Bug That's Been in Macs Since 1999, Unpatched Bug Let Attackers Bypass Windows Lock Screen On RDP Sessions, Google confirms that advanced backdoor came preinstalled on Android devices, and Quest Diagnostics data breach: Nearly 12 million patients had personal info exposed.
Cyber Security News ending June 8 2019
A laptop filled with six of the world’s most dangerous viruses is on sale for more than $1 million, Why you should never use phone charging stations at airports, Google Stored G Suite Users' Passwords in Plain-Text for 14 Years, Snapchat Employees Reportedly Spied on Private Snaps, and In Baltimore and Beyond, a Stolen N.S.A. Tool Wreaks Havoc.
Memorial Day Cyber Security News 2019
The Trade Secret: Firms That Promised High-Tech Ransomware Solutions Almost Always Just Pay the Hackers, Huawei has secret ‘backdoor’ into major European telecoms firm, spy agency reportedly says, Hackers breach Stack Overflow Q&A platform and compromise users' data, WhatsApp security breach may have targeted human rights groups, and What you need to know if you e-transfer money.
Cyber Security News Ending May 18 2019
How to stop Google from tracking web history, Baltimore City Hall Computer Network Infected With Ransomware Virus, Officials Say, Types of backup and five backup mistakes to avoid, Binance Security Breach Update, and Israel Neutralizes Cyber Attack by Blowing Up A Building With Hackers.
Cyber Security News Ending May 12 2019 Mothers Day Edition
Microsoft knows password-expiration policies are useless, Docker Hub Suffers a DataBreach, Asks Users to Reset Password, Over 23 million breached accounts used ‘123456’ as password, A 'Blockchain Bandit' Is Guessing Private Keys and Scoring Millions, and Fort Bragg Army cut power to thousands as cyber-attack test.
Cyber Security News ending April 27 2019
Experts: Breach at IT Outsourcing Giant Wipro, Don’t Acquire a Company Until You Evaluate Its Data Security, Microsoft reveals breachaffecting webmail users, Mueller Report Obama’s NSA Director Told U.S. CyberSecurity Team to “Stand Down” in Face of Russian Hackers, and CIA Offers Proof Huawei Has Been Funded By China's Military And Intelligence.
Cyber Security News ending April 21 2019
Mysterious safety-tampering malware infects a second critical infrastructure site, WikiLeaks Founder Julian Assange Arrested After Ecuador Withdraws Asylum, Samsung’s Galaxy S10 fingerprint sensor fooled by 3D printed fingerprint, Security Flaws in WPA3 Protocol Let Attackers Hack WiFi Password, and Secret Service agent inserted malware-infected USB drive into laptop.
Weekly Cyber Security News ending April 13 – From the Cyber Chronicle Cyber Security News Podcast
Subscribe