Cyber Security Tribe

American Interiors faced a substantial security risk and were challenged in how best to address it. Niche software required local admin rights which meant changes could be made, including removing security tools whether intentionally or accidentally. It wasn’t until Rob Whitten came across ThreatLocker on the highway (really!) that he was able to solve the problem and remove one of the biggest risks to the company.

Most AI security tools are hype. Security leaders know it. That does not mean we are writing AI off.The better questions are where it helps, what is holding adoption back, and what a tool has to prove before it earns a place on the team. I have sat in the CISO seat long enough to be skeptical of new tooling. I also cannot picture any CISO watching this shift from the sidelines. So at Surf we asked. In the summer of 2026, we surveyed 51 senior security and IT leaders from our professional network.

Why CISOs Need to Rethink Third Party Risk Management 12:13 Third-Party Risk Management (TPRM) is not new discussion; it’s been a topic as long as I can remember and as long as I’ve been doing this (that’s a long time!). But it’s evolving. The concerns today are being amplified by AI, specifically when vendors add AI into their solutions after contracts have been signed. Fourth-party risk has also become increasingly important because, of course, every vendor has vendors of their own.

Why organizations need a way to keep critical software secure when it can’t be replaced overnight. Legacy infrastructure rarely gets replaced on the schedule originally intended. A system may have been expected to run for five years and still be handling critical workloads a decade later because the application built around it is difficult to migrate, the dependencies are tightly coupled or the business cannot justify the disruption involved in replacing something that still works.

Why warnings from leading laboratories, policymakers, and technology executives deserve neither panic nor dismissal. Introduction For years, public debate about artificial intelligence moved between two shallow extremes. One camp marketed AI as a productivity tool destined to make every organization faster, cheaper, and more capable. The other warned, often in vague language, that machines would eventually become conscious, hostile, and uncontrollable. Neither picture was adequate.

INFOGRAPHIC - Why Endpoint Security Must Go Beyond EDR in the AI Era 0:40 Following our recent Cyber Security Tribe online fireside chat, this infographic highlights a selection of the thought leadership and insight provided by our leading industry panelists, helping CISOs and senior cybersecurity professionals to "Build an Endpoint Strategy Ready for the AI Era".

Cybersecurity debt in manufacturing rarely starts with a bad decision. More often, it starts with a reasonable one made at 2 a.m. when a line is down, a vendor needs access, or a production change cannot wait for the next maintenance window. A firewall rule is opened. A legacy system stays in service for another year. A local account is created because the normal identity path will not work on an older machine.

Cybersecurity defenses have traditionally been designed around a human adversary. Security teams have built their tools, processes and operating models on assumptions about how people identify weaknesses, move through an environment and use stolen information. The arrival of AI challenges those assumptions because attackers can now combine human intent with machine speed, scale and analytical capabilities. This change is not simply allowing threat actors to perform familiar tasks more quickly.

In this Q&A article with Emily Heath, we dig into the most prevalent issues that security leaders face: AI and Endpoint Security. Cyber Security Tribe: There’s this balancing act that has always been around, but it is so prevalent now because of AI, and that's that balance of business enablement and innovation, while also risk reduction. How do you continue to reduce the risk, but also allow the organization to move forward at the pace at which they desire, especially in the AI Era?

Interview with Julie Myerholtz, CISO, Brunswick Corporation The discussion around CISO reporting is more prevalent than ever. With conflicting priorities, at times, between business and security, the shift has begun. At one time, the majority of CISOs reported to the CIO or CTO; however, with the speed at which businesses are focusing on technological advancements and with AI leading much of it, security must be at the forefront of decision-making.