Sign in Subscribe

Brian Weidner

Brian Weidner

CISO Weekly Brief: Zero-Day Exploits, Identity Threats, and AI Abuse (Feb 12, 2026)

This week’s security landscape is marked by multiple zero-day vulnerabilities, sophisticated identity attacks, and the growing abuse of AI in cyber operations. CISOs should focus on rapid patching, monitoring for credential theft, and preparing for advanced threat scenarios. Below are the top items requiring executive attention, followed by

NIST CSF 2.0 – GOVERN (GV.SC): Governing Cyber Risk Beyond Your Organizational Boundaries

NIST CSF 2.0 – GOVERN (GV.SC): Governing Cyber Risk Beyond Your Organizational Boundaries

Cybersecurity governance does not stop at your network perimeter. Modern enterprises rely on a complex ecosystem of vendors, cloud providers, SaaS platforms, integrators, and partners. Each dependency introduces risk—often outside the direct control of the CISO. GV.SC (Supply Chain Risk Management) exists to ensure those risks are governed

CISO Brief: February 11, 2026 – Critical Vulnerabilities, Nation-State Threats, and Ransomware Developments

Staying ahead of emerging threats is essential for enterprise resilience. This week brings a mix of critical vulnerabilities, advanced ransomware, and sophisticated nation-state activity. CISOs should prioritize patching, review detection capabilities, and prepare executive responses to evolving risks. Below are the top items requiring immediate attention, notable developments, and

Choosing the Right Security Framework for Your Organization

Choosing the Right Security Framework for Your Organization

How to pick a framework that fits, scales, and actually covers what your business needs — including regulatory risk If you've spent any time in information security, you've heard the word "framework" thrown around a lot. NIST this, ISO that, somebody in the corner mumbling

NIST CSF 2.0 – GOVERN (GV.OV): Turning Governance Into Oversight That Works

NIST CSF 2.0 – GOVERN (GV.OV): Turning Governance Into Oversight That Works

In the previous post on GV.PO – Policies, Processes, and Procedures, we focused on how organizations define expectations for cybersecurity. But governance does not stop at documentation. Policies without oversight are aspirational at best—and risky at worst. This is where GV.OV (Oversight) comes in. Under NIST CSF 2.

NIST CSF 2.0 Policies, Processes, and Procedures (GV.PO): Turning Governance Into Operational Reality

NIST CSF 2.0 Policies, Processes, and Procedures (GV.PO): Turning Governance Into Operational Reality

After decades leading cybersecurity programs in large, global organizations, I’ve learned that governance only matters when it shows up in daily decisions. Policies that live in binders, processes that no one follows, and procedures that exist only for audits do not reduce risk—they create the illusion of control.

NIST CSF 2.0 Roles, Responsibilities, and Authorities (GV.RR): Eliminating Ambiguity in Cybersecurity Leadership

NIST CSF 2.0 Roles, Responsibilities, and Authorities (GV.RR): Eliminating Ambiguity in Cybersecurity Leadership

After more than twenty years leading cybersecurity programs in global enterprises, I’ve seen sophisticated security architectures fail for one simple reason: no one was truly accountable. Technology does not fail in isolation—organizations do. GV.RR exists to eliminate the ambiguity that undermines even the most mature security programs