David Etue

expert panel

Cybercriminals don’t always need sophisticated tactics to cause devastating damage. Sometimes, they just need an opening left by a neglected security safeguard. And the financial stakes are staggering: The average cost of a data breach in the U.S. has reached $11.5 million.For businesses, implementing foundational cybersecurity practices is only half the battle. The harder challenge is ensuring they remain effective as technology evolves, operations expand and competing priorities pull attention elsewhere. That challenge is becoming increasingly difficult: A 2026 survey found that 68% of IT and cybersecurity professionals say their jobs have become harder over the past two years, with more than half reporting increased complexity and workloads. When security teams are stretched thin, even well-established safeguards can fall victim to inconsistent oversight—leaving preventable gaps that attackers can exploit.Building lasting cyber resilience requires more than knowing what works; it demands the discipline to keep doing it. Members of the Senior Executive Cybersecurity Think Tank draw on extensive experience in enterprise security, risk management and breach prevention to examine this persistent challenge. Below, they identify foundational security practices organizations still struggle to sustain and explain what it takes to make those protections stick.

expert panel

Cyber exercises give an organization a chance to uncover weaknesses before a real attack puts its response to the test. Yet what teams rehearse often differs from what they face. A 2025 survey of 480 senior U.S. cybersecurity leaders found that 57% of significant cyber incidents involved attacks the security team hadn’t prepared for. Since no organization can rehearse every scenario, the value of an exercise lies less in the script than in whether it builds the judgment and coordination a response will need when events don’t go according to plan. A scenario that simply walks the security team through familiar technical steps reveals little about how the business would function when a critical vendor goes dark, core systems are unavailable, or executives must make high-stakes calls about operations, disclosure and customer communication with incomplete information. CISA has advised that incident response plans include senior business leadership and board members and that senior management participate in tabletop exercises, reflecting the view that cyber readiness must extend well beyond the security team.Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity strategy, risk management, incident response and cybersecurity leadership. Below, they explore what separates a useful cyber exercise from a compliance-driven tabletop and how leaders can design exercises that test executive judgment, operational dependencies and cross-organizational coordination.

expert panel

Software supply chain security is often treated as a gatekeeping problem: Keep malicious code from entering the environment. But modern applications are built from dense webs of open-source and third-party dependencies, and a single compromised package can surface across numerous applications and systems downstream, far beyond the first project that installs it.Recent attacks have shown how quickly that risk can multiply. In September 2025, the self-replicating Shai-Hulud worm infiltrated the npm ecosystem through compromised maintainer accounts, spreading automatically across the registry by hijacking developer credentials. By the time it was contained, the worm had compromised more than 500 packages, prompting GitHub to remove them from the registry to stop further propagation.For security leaders, the challenge isn’t only determining whether a package is safe at the point of entry—it’s understanding how far a compromise could travel once that software is already embedded across an organization. Supply chain risk is compounded when organizations lack visibility into how the technology they rely on is developed, integrated and deployed.Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity strategies, data breach prevention, risk management, threat detection and modern security architecture. Here, three of them examine how leaders should assess the downstream risk posed by poisoned software dependencies and what meaningful prevention and containment look like when a single compromised component has the potential to affect many systems.

expert panel

Cybersecurity has long been a race between attackers trying to get in and defenders trying to keep them out. But frontier AI is changing the pace of that race. By helping threat actors discover vulnerabilities, conduct reconnaissance and experiment with attack techniques more quickly and at a greater scale, AI can shrink the time security teams have to recognize a threat and respond before it causes damage. Offensive activities that once took weeks can increasingly be compressed into minutes. That shift also challenges a more fundamental assumption behind traditional detection: that defenders will recognize enough of an attack to know what they’re looking for. Frontier AI can help adversaries vary techniques, combine attack methods and explore unfamiliar paths at a scale that makes relying primarily on established signatures, indicators and playbooks increasingly risky. Cybersecurity guidance is consequently evolving toward models that account for AI-enabled attacks while also using AI to strengthen defense and proactively address emerging threats.Preparing for that environment means looking beyond how quickly an organization can identify an attack to how much room for maneuver its systems leave an attacker in the first place. Members of the Senior Executive Cybersecurity Think Tank share deep expertise in enterprise cybersecurity strategies, data breach prevention, risk management, threat detection and modern security architecture. Below, they explore how security leaders should adapt their defenses for an AI-accelerated threat landscape and which capabilities are becoming most important.

expert panel

An attacker who gains access through a stolen credential may quickly move across devices, cloud resources and network systems in search of valuable data or greater control. Each step can generate clues, but when those signals land in separate tools and queues, security teams may struggle to recognize the full attack before the damage spreads.This challenge is becoming harder to tackle as traditional boundaries between users, devices, applications and infrastructure continue to dissolve. NIST’s zero-trust guidance reflects that shift, moving security away from static, network-based perimeters and toward continuous decisions based on users, assets and resources. This same erosion of boundaries is what makes it harder to catch attackers who don’t need to break anything to move around. CISA’s guidance on identifying and mitigating “living off the land” techniques warns that attackers can abuse legitimate, trusted tools and processes to blend in with normal system activity, making isolated alerts harder to interpret without broader context.Yet many organizations still measure security effectiveness largely by how well they detect suspicious activity. Detection remains essential, but alerts alone don’t determine which risks matter most, coordinate action across environments, or help the business continue operating when defenses fail. That requires an approach that connects visibility with timely decisions, enforceable controls and plans for maintaining and restoring critical operations.Moving beyond a detection-centric model means reconsidering how security data, decisions and defenses work together across the enterprise. Below, members of the Senior Executive Cybersecurity Think Tank—with expertise in enterprise cybersecurity strategies, data breach prevention, risk management, threat detection and cybersecurity leadership—explain what a more unified, real-time approach to visibility, control and resilience should look like.

expert panel

Vulnerability management used to depend on a familiar rhythm: A new flaw was disclosed, public databases added analysis and security teams worked through the queue by severity. That model is now straining under its own weight. Vulnerability disclosures keep climbing, but the National Vulnerability Database has faced a significant operational breakdown: Beginning in early 2024, NIST sharply slowed enrichment of new CVE entries, and in April 2026, NIST formally announced it would no longer enrich all CVE entries, moving to a triage model that leaves the majority of submissions without scores, metadata or supporting analysis.Security leaders need to rethink defensive strategies, from monitoring to remediation. Even with the help of automation, teams with limited resources can’t approach every vulnerability with equal urgency, and waiting for more complete information can leave a business exposed while attackers keep moving. Security teams must learn to weigh new vulnerabilities in terms of the organization’s real environment, operational priorities and potential business impact. In a world of incomplete signals, security leaders need a sharper sense of which risks matter now, which can wait and which require a different kind of control altogether. Members of the Senior Executive Cybersecurity Think Tank are leaders in enterprise cybersecurity strategies, data breach prevention, risk management and modern security architecture. Below, they share how organizations can rethink vulnerability risk assessment as public data becomes less complete and focus attention where it can have the greatest protective impact.