Loading story…
InfoSec World 2025 convened cybersecurity professionals, industry leaders, and innovators at Disney’s Coronado Springs Resort in Orlando, Florida, for a week of keynotes, panels, and live coverage focused on the evolving landscape of cyber risk and defense. The event featured a keynote conversation with Dr. Ron Ross, a leading architect of national cyber defense frameworks, who discussed urgent priorities and transformative strategies for improving cybersecurity posture, as well as the importance of freely available tools for practitioners. The conference also introduced Security Control Management (SCM) as a new software category, emphasizing the shift from manual compliance to proactive, embedded defense, and included recaps and live interviews highlighting the expansion of programming such as the CISO Summit, Women in Cyber Summit, and AI Summit.
Sessions at InfoSec World 2025 addressed the need for speed and agile innovation in cybersecurity, with discussions on integrating risk management frameworks into engineering practices and the rise of automated security control platforms. The event underscored the importance of unifying fragmented compliance practices, embedding security into system development lifecycles, and empowering organizations to make real-time security decisions. Coverage from CyberRisk TV and Security Weekly provided insights into the conversations and trends shaping the future of cybersecurity, reinforcing InfoSec World’s role as a central forum for advancing industry knowledge and collaboration.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
SC Media published a conversation with Dr. Ron Ross along with a recap of Day 2 of InfoSec World 2025, indicating continued conference coverage and follow-up discussion of the event's themes.
SC Media published event-related content on executing the Risk Management Framework as an engineering discipline and on the rise of security control management, reflecting conference discussions on security governance and implementation.
SC Media published kickoff coverage for InfoSec World 2025, including a segment titled "Kicking Off InfoSec World 2025: The Great Cyber Race Begins." This marks the start of the event's reported proceedings.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity leaders and experts are emphasizing the need for a fundamental shift in how organizations approach security management, advocating for more scalable, standardized, and industrialized practices. Phil Venables, Strategic Security Advisor at Google, highlighted at the ISC2 Security Congress that traditional, "artisanal" security programs are no longer sufficient for today's complex environments, urging the adoption of industrial cybersecurity models that prioritize scalability, reliability, and rapid recovery. Dr. Ron Ross, a NIST Fellow, echoed this sentiment at InfoSec World 2025, warning that the industry must rebuild its foundations by focusing on secure-by-design principles and trustworthy engineering at the hardware, software, and firmware levels to address growing attack surfaces and systemic vulnerabilities. Simultaneously, the role of the CISO is evolving to encompass broader business responsibilities, including trust-building and cross-industry adaptability. Discussions at major conferences and in industry analysis point to the emergence of the Chief Trust Officer role, reflecting the increasing importance of trust and risk management in business outcomes. Experts also stress the human factor as a persistent risk and potential defense in cybersecurity, with events like IRISSCON 2025 focusing on the psychological and operational aspects of security. These developments underscore a growing consensus that effective cybersecurity leadership now requires a blend of technical rigor, business acumen, and a proactive approach to both technology and human elements within organizations.
Jul 12, 2026
Security leaders are increasingly focused on proactive defense, digital trust, and adapting to the rapidly changing threat landscape. Insights from industry experts highlight that while a majority of organizations recognize cybersecurity as a top priority, only a minority invest in proactive measures, leaving many exposed to risks from legacy systems, supply chain dependencies, and sophisticated nation-state campaigns. The integration of AI is accelerating breach timelines, and cyber insurance is evolving from a financial safety net to a measure of organizational hygiene. Public–private collaboration and intelligence sharing are seen as critical in responding to large-scale infrastructure threats, particularly those posed by nation-state actors such as China. At the same time, enterprise security strategies are being shaped by lessons learned from misconfigurations, the adoption of new frameworks, and the operationalization of Security Control Management (SCM). Experts emphasize the need for unified control selection, mapping, and enforcement to move from reactive compliance to proactive, data-driven defense. Mid-sized organizations face unique challenges due to mobility and third-party reliance, but automation and integration are enabling faster, more effective security decisions. The convergence of these trends underscores the urgent need for CISOs to address blind spots and build resilience before the next crisis emerges.
Jun 29, 2026
The cybersecurity landscape in 2025 saw significant evolution, with a marked increase in supply chain attacks targeting CI/CD pipelines, open source packages, and developer tooling. Organizations like StepSecurity reported detecting and responding to some of the most consequential supply chain compromises before they became public, highlighting the need for real-time visibility and enforcement across software supply chains. The year also witnessed rapid growth in the adoption of security solutions, as enterprises sought to protect their development environments and open-source repositories from increasingly sophisticated threats. Simultaneously, the industry experienced major shifts in technology and risk management. Startups drove innovation in browser security, application security for AI-generated code, and SOC automation, reflecting the growing importance of cloud-based workspaces and AI-driven applications. On the risk management front, CISOs faced a tightening cyber insurance market, with insurers demanding more rigorous proof of security controls and warning that major supply chain or AI-related incidents could quickly harden underwriting standards. These developments underscore the need for organizations to adapt their security strategies to address both emerging technical threats and evolving risk management requirements.
Jun 29, 2026