Loading story…
Security leadership-focused reporting highlighted rising concern over third-party and software supply chain risk, with a Panorays survey of 200 US CISOs reporting that 60% observed an increase in third-party security incidents and that more than three-quarters view third-party software risk as a major concern. The same coverage pointed to expanding dependency on external services (often 100–300 SaaS apps per enterprise) and noted that broader AI adoption is increasing attack surface while also being used defensively to improve detection and response.
Separate CISO-oriented content emphasized organizational and programmatic pressures rather than a discrete incident: Dark Reading described a CISO succession/turnover problem (average tenure cited at 18–26 months) and linked rapid leadership churn—especially during M&A integration—to compounding security risk and burnout. Other items in the set were not incident-driven: one was a CSO Online navigation/feature listing around application security approaches (e.g., SCA/SAST/DAST/MAST), and another was a TechTarget roundup promoting cybersecurity conferences to attend in 2026; neither provided specific breach, vulnerability disclosure, or actionable threat intelligence.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
The Panorays survey reported that two-thirds of CISOs are already adopting AI-powered tools to modernize vendor risk assessment, while nearly all remaining respondents plan to do so in response to growing third-party vulnerabilities.
Panorays' latest annual survey of 200 U.S.-based CISOs found that 60% observed an increase in third-party security incidents this year, with software supply chain risk ranking among the top cybersecurity concerns. The report also found only 15% had full visibility into their software supply chains and just 21% had incident response plans for breaches originating from external software suppliers.
Industry estimates cited in the report placed average CISO tenure at roughly 18 to 26 months, with experts describing how leadership churn pauses projects, delays controls, and erodes institutional knowledge. The article framed rapid CISO turnover as a structural risk that can repeatedly reset long-term security programs.
A 2024 Heidrick & Struggles survey found that 47% of CISOs reported having no adequate internal successor, highlighting weak succession planning in security leadership pipelines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A *Panorays* survey of 200 U.S. CISOs reported rising **third-party security incidents** alongside major visibility gaps across extended vendor ecosystems. In the findings cited by Help Net Security and SC Media, **60%** of CISOs said third-party incidents increased over the past year, while only **15%** said they have full visibility into third-party risk across deeper supply-chain tiers (third-, fourth-, and beyond). The reporting emphasizes that vendor dependencies now span core functions (cloud, software development, data processing, and AI services), expanding attack surface and enabling attackers to exploit less-monitored downstream relationships such as subcontractors and affiliates. The survey also pointed to weak preparedness and governance as compounding factors: while **77%** of CISOs view third-party risk as a major threat, only **21%** reported having tested crisis response plans, and only **41%** monitor risk beyond direct suppliers. Both articles highlight **unmanaged/“shadow” AI tools** as an emerging third-party risk driver, with only **22%** of organizations having formal AI vetting processes and **60%** of respondents identifying shadow AI as uniquely risky—creating new, poorly understood pathways for supply-chain compromise and regulatory exposure.
Jun 29, 2026
Security leaders are increasingly focused on proactive defense, digital trust, and adapting to the rapidly changing threat landscape. Insights from industry experts highlight that while a majority of organizations recognize cybersecurity as a top priority, only a minority invest in proactive measures, leaving many exposed to risks from legacy systems, supply chain dependencies, and sophisticated nation-state campaigns. The integration of AI is accelerating breach timelines, and cyber insurance is evolving from a financial safety net to a measure of organizational hygiene. Public–private collaboration and intelligence sharing are seen as critical in responding to large-scale infrastructure threats, particularly those posed by nation-state actors such as China. At the same time, enterprise security strategies are being shaped by lessons learned from misconfigurations, the adoption of new frameworks, and the operationalization of Security Control Management (SCM). Experts emphasize the need for unified control selection, mapping, and enforcement to move from reactive compliance to proactive, data-driven defense. Mid-sized organizations face unique challenges due to mobility and third-party reliance, but automation and integration are enabling faster, more effective security decisions. The convergence of these trends underscores the urgent need for CISOs to address blind spots and build resilience before the next crisis emerges.
Jun 29, 2026
Security leaders are signaling that **2026 risk will be dominated by faster, cheaper, and more credible attacks enabled by AI and automation**, with adversaries increasingly targeting **identity and cloud access** rather than endpoints. Commentary highlighted growing exposure from “internet monoculture” concentration in major cloud/CDN/productivity providers, rising **deepfake/voice-cloning and synthetic-identity** abuse that erodes trust in authentication, and longer-term **“collect now, decrypt later”** concerns tied to quantum risk. In parallel, organizations are being pushed toward operating models emphasizing **speed, automation, and continuous identity verification**, while also updating resiliency playbooks to explicitly account for AI behavior and accountability. Operationally, workforce data indicates **U.S. cybersecurity leaders average ~10.8 hours of overtime per week**, with reported burnout and expanding responsibilities as AI governance and business-risk communication become more central to the role. Several items in the set are not incident-driven: one is a conference write-up (ThreatLocker’s *Zero Trust World 2026*) and others are strategy/career pieces (secure-by-design/SDLC applied to governance and human error; CSO role definition). One reference points to a distinct law-enforcement action—**a 14-country operation that dismantled the LeakBase cybercrime marketplace**—which is a separate event from the 2026 leadership/outlook theme, and another appears to be a vendor/platform expansion blurb rather than a specific threat or disclosure.
Jun 29, 2026