Tag: CISO

  • Ledger Consolidates Security and IT Leadership Amid Surging AI Crypto Attacks

    Ledger Consolidates Security and IT Leadership Amid Surging AI Crypto Attacks

    Ledger SAS has appointed Oded Blatman as chief information officer and chief security officer, combining technology and security oversight in a single leadership role as AI-driven threats expand across the crypto industry. The Paris-based hardware wallet maker said Blatman will oversee cyber and infrastructure security, product security, physical and workplace security, internal IT, and enterprise risk.

    One Role for Security and Technology

    Blatman joins Ledger after five years as CIO and CISO at Fireblocks. He previously served as global CISO at Bank Hapoalim and held both CIO and CISO roles at ClickSoftware. At Fireblocks, he led global security and enterprise technology during a period of international expansion and rising operational complexity, experience Ledger says fits its broader effort to strengthen organizational resilience.

    Ledger described the combined CIO and CSO structure as a deliberate organizational change. The company said information systems and security now require closer coordination as tokenization, AI agents, and institutional digital-asset use develop together.

    AI Makes Crypto Attacks Faster and More Scalable

    Blatman said artificial intelligence is reducing the cost and time attackers need to search for weaknesses, while also allowing attacks to become more sophisticated and operate at greater scale. As phishing campaigns and deepfake impersonation schemes become more advanced, Ledger said security teams must evolve at a comparable pace.

    The appointment follows a rise in reported crypto security incidents. Data from DefiLlama cited by Ledger shows hackers stole about $1.4 billion across 250 attacks in 2026 so far, after losses reached $2.7 billion across 146 attacks in 2025.

    Recent Incidents Add Pressure on Digital Asset Defenses

    Several high-profile incidents have put digital-asset companies on alert. About $320 million in Bitcoin left the Liquid Network during a hack earlier this week. Trezor also disclosed a breach involving one of its shipping providers last week, exposing personal information belonging to tens of thousands of customers. Earlier this year, a Coldcard hack raised further questions about offline wallet security.

    Ledger said hardware-backed verification remains central to protecting high-value digital ownership, and pointed to secure software, resilient operations, and verifiable human intent as additional layers of protection.

    Leadership Backed by Deep Security Experience

    Blatman said Ledger’s hardware-security work, user trust, and Donjon research team provided a strong foundation for the role, and that he joined to connect product security, enterprise technology, and resilience. Chairman and CEO Pascal Gauthier said Ledger considers security central to its business and that Blatman’s experience protecting systems at Fireblocks and Bank Hapoalim prepared him to oversee both information technology and security.

  • New Research Reveals Measurable Confidence Gap Between CISOs and Boards, Pulse Security AI Report Finds

    New Research Reveals Measurable Confidence Gap Between CISOs and Boards, Pulse Security AI Report Finds

    Boards of directors believe they understand their company’s security posture and its business implications, but the security leaders presenting to them are far less confident. According to new research from Pulse Security AI, only 12.5% of security leaders are very confident that their board walks away with an accurate understanding of the program, and 55% of boards have never formally defined the level of cyber risk the company is willing to accept.

    Pulse Security AI unveiled these findings today in The CISO-Board Communication Gap, a research report drawing on insights from more than 80 senior practitioners. The report examines how security leaders report to their boards and what gets lost in translation.

    “For a decade, the industry has told security leaders to communicate better with the board,” said Mike Armistead, CEO and co-founder of Pulse Security AI. “Our data says the problem is upstream of that. You cannot report status against a baseline that was never set.”

    Top Five Insights from the Research

    1. The Confidence Gap is Measurable

    Only 12.5% of security leaders are very confident their board accurately understands the program after a presentation. 41% land at somewhat confident, and 38% are neutral or mixed. Both sides leave the room, and the cycle continues largely unchanged.

    2. The Baseline Was Never Set

    55% of boards have never formally defined cyber risk appetite, and another 27% define it only qualitatively. Without an agreed baseline, external noise fills the vacuum: roughly 70% of security leaders say board members bring third-party ratings and press coverage into the room, and 42% had to defend a commercial security score in the past 12 months.

    3. Board Prep is an Operational Tax

    71% of security leaders spend 10 or more hours preparing for each board cycle—one to two full working days every quarter—and 39% involve four or more contributors per presentation. The top time sinks: building slides, gathering data across tools, and translating findings into business language.

    4. Governance Runs on Instinct, Not Instrumentation

    Half of boards made no explicit decision to accept, mitigate, or transfer cyber risk in the past year. 48% of security leaders have no private executive session access, 23% have no predefined threshold for board-level escalation, and 33% say their own legal exposure shapes what they tell the board.

    5. Trust is Recoverable—and a Breach Shouldn’t Be the Trigger

    53% of security leaders say board trust increased after a material security incident. A real event forces a shared, concrete understanding of risk that quarterly updates rarely produce. The report details five practices, drawn from leaders with the highest board trust, for creating that alignment.

    Armistead continues, “You cannot assemble a clear picture of the business when the underlying information lives in a dozen disconnected places. Security leaders have earned the room. What they need now is the operating layer underneath it.”

    The full report, The CISO-Board Communication Gap, is available for download at pulsesecurity.ai/newsroom/ciso-board-communication-gap/.

    Methodology

    Findings draw on a 42-respondent survey of security leaders and corporate directors, more than 20 in-depth interviews with sitting and former CISOs, and two moderated workshops with roughly 22 CISOs. Seventy percent of survey respondents are CISOs or heads of security. Industries represented include technology and software (34%), financial services (25%), healthcare and life sciences (9%), and manufacturing (9%). These are not nationally representative statistics. Their value is depth and seniority: participants are the people who sit in audit committee meetings. Percentages are computed on those answering each question. A small corporate-director sub-sample is treated as directional only. Quotes are anonymized at participants’ request.

    About Pulse Security AI

    Pulse Security AI is redefining how cybersecurity programs are run. Pulse is an operational management platform for security leaders, where security professionals and AI agents work together to execute procedures, capture decisions, and deliver real-time program visibility without the manual overhead. The result is a security organization that runs faster, costs less, and gives leaders clear confidence in where their program stands.

    This is a paid press release published via CyberNewswire, a PR newswire syndication platform for cybersecurity companies.

  • Pulse Security Unveils AI-Powered Operational Management Platform for CISOs

    Pulse Security Unveils AI-Powered Operational Management Platform for CISOs

    Pulse Security AI emerged from stealth today, backed by $8 million in seed funding led by Foundation Capital with participation from Zetta Venture Partners. The company aims to solve a long-standing gap in cybersecurity: providing security leaders with the same operational foundation that other business functions take for granted.

    For decades, security teams have invested in purpose-built tools for practitioners—SOC analysts, threat hunters, vulnerability managers—yet the program itself has been managed through spreadsheets, slide decks, and tribal knowledge. The pressure is mounting as CVE submissions rose 263% from 2020 to 2025, and SEC disclosure rules now place cyber risk squarely in the boardroom.

    Pulse Security’s platform is built on a context graph architecture that sits above existing technical silos—EDR, cloud, identity, and unstructured data sources like assessment reports and tracking spreadsheets. By integrating risks, technical environments, regulatory obligations, people, and business priorities, the platform gives CISOs a consolidated system of record to formulate strategy, automate workflows, and communicate with authority.

    “The security industry has spent decades building better tools for practitioners and almost nothing for the leader who runs the program,” said Mike Armistead, CEO and co-founder of Pulse Security AI. “A CFO reconciles finances through an ERP. A CRO captures tribal knowledge with a CRM. Security leaders have never had the equivalent. Pulse is the foundation they need to run their programs the way other functions leverage their management systems.”

    The company was co-founded by product and security experts Mike Armistead, Robert Hipps, and Nick Gilligan. Armistead and Hipps previously co-founded Respond Software, acquired by FireEye/Mandiant for $186 million, and Armistead also co-founded Fortify Software, acquired by HP. Gilligan was among Respond’s first technical hires and later led AI engineering teams at Mandiant and Google.

    “We were fortunate to work closely with the Pulse team through our early investment in Respond, so I know they can deliver real transformation in security,” said Sid Trivedi, Partner at Foundation Capital. “The problem Pulse addresses is massive, expensive, and still solved largely by human effort. CISOs face accelerating risks that siloed technologies cannot address.”

    Apoorva Pandhi, Managing Director at Zetta Venture Partners, added: “Security leaders today are expected to make high-stakes decisions across an increasingly complex organization, yet most still operate across fragmented tools, endless workflows, and incomplete visibility.”

    The funding will accelerate Pulse’s engineering and go-to-market efforts to meet enterprise demand from security leaders ready to modernize how their programs are run.

  • Best AI Attack Surface Monitoring Platforms for CISOs in 2026

    Best AI Attack Surface Monitoring Platforms for CISOs in 2026

    Every model, API, agent, MCP server, vector store, and prompt an enterprise puts into production is a new attack surface, and most of it sits outside the tools security teams already run. Traditional scanners look for code defects. Cloud posture tools watch configurations. Neither can detect a prompt injection, enumerate an exposed MCP server’s tool registry, or tell whether an autonomous agent has been manipulated into exfiltrating data through a legitimate-looking tool call.

    For CISOs, the gap is now a board-level problem. OWASP ranks prompt injection as the number one risk for LLM applications. Cisco’s 2025 AI Readiness Index found that 83% of organizations plan to deploy AI agents, yet only 31% report they are fully equipped to secure them. Gartner projects that more than 40% of agentic AI projects will be canceled by the end of 2027, partly because of inadequate risk controls. The exposure is not theoretical: CloudSEK’s AIVigil recently found an unauthenticated MCP server in a customer environment that chained into server-side request forgery, local file inclusion, and live AWS credential theft.

    AI attack surface security has become a real buying category in 2026, and it spans several distinct layers. This guide covers five platforms that belong on a CISO shortlist, each strong in a different part of the AI attack surface.

    What Makes the AI Attack Surface Different

    The AI attack surface is not an extension of the traditional one. It is a distinct layer with its own exposure patterns and its own class of initial access vectors. A production AI agent with retrieval, memory, tool access, MCP servers, and permissions has many paths an attacker can influence, and those paths change daily as models update and integrations are added. Prompt injection, model abuse, agent hijacking, training data exposure, and vector database leakage all operate at the model and inference layer, not the code layer, which is why SAST, DAST, CSPM, and conventional attack surface management miss them. Securing this surface requires purpose-built discovery, assessment, and monitoring.

    Layers of AI Attack Surface Monitoring

    No single platform covers the whole AI attack surface equally, so it helps to think in layers. The five platforms below each lead to a different one.

    • External exposure and attack path. Internet-reachable AI assets and how an exposure chains into a breach.
    • Full-lifecycle platform security. Discovery through runtime defense across apps, agents, and models.
    • Cloud AI posture. AI assets, misconfigurations, and attack paths inside the cloud environment.
    • Identity-centric posture. Least-privilege and shadow AI tied to human and machine identities.
    • Model-layer security. Model scanning, adversarial testing, and supply chain integrity.

    5 Recommended Platforms for AIASM

    1. CloudSEK AIVigil

    Leads on: external AI attack surface and attack-path correlation.

    CloudSEK AIVigil is an AI attack surface monitoring platform built for enterprises that need to find externally exposed AI assets and trace how they chain into an attack path. AIVigil monitors the AI attack surface from the outside in, the way an attacker sees it. It continuously discovers internet-reachable AI assets, including exposed MCP servers, public inference and model-serving endpoints, leaked AI credentials, and shadow AI, and builds them into an AI Bill of Materials. It then probes each asset with MCP-specific scanning, agentic workflow analysis, AI supply-chain scanning, and active AI red-teaming, scoring exposures by agent agency, authentication state, and blast radius. Its distinguishing move happens after discovery. Findings feed Nexus AI, CloudSEK’s attack-path layer, which correlates an AI exposure with dark web exposure from XVigil, threat actor activity from CloudSEK Threat Intelligence, and third-party risk from SVigil into a validated attack path. The result answers a question most AI security tools do not: not just what is exposed, but how an attacker would chain that AI weakness with a leaked credential or vendor exposure into a real route to compromise.

    Best for: enterprises that want the attacker’s-eye view of their exposed AI assets, tied to the attack paths those exposures open.

    2. Palo Alto Networks Prisma AIRS

    Leads on: full-lifecycle AI security within the Palo Alto ecosystem.

    Palo Alto Prisma AIRS, now in its 3.0 release, secures enterprise AI across the full lifecycle, from pre-deployment discovery to real-time runtime defense. It discovers and inventories AI apps, agents, including shadow agents, and models. It defends against prompt injection and tool misuse inline, performs architectural analysis of models to detect backdoors and data poisoning, and includes AI red teaming. Its value is highest for enterprises already invested in Palo Alto’s security architecture.

    Best for: large enterprises in Palo Alto that want lifecycle AI security in a single platform.

    3. Wiz AI-SPM

    Leads on: cloud-native AI security posture.

    Wiz delivers AI Security Posture Management inside its cloud-native application protection platform, discovering AI services, models, and training data across cloud accounts and surfacing misconfigurations and exposed data in the same security graph it uses for cloud risk. It extends cloud attack-path analysis to AI endpoints and covers AWS, Azure, and GCP along with Azure OpenAI and Microsoft Copilot Studio. Its strength is cloud infrastructure, where it concentrates, so on-premises and SaaS-embedded AI coverage is thinner.

    Best for: teams standardized on Wiz that want AI posture folded into their existing cloud risk graph.

    4. CrowdStrike Falcon AI-SPM

    Leads on: identity-centric AI posture within Falcon.

    CrowdStrike extends its Falcon platform with AI Security Posture Management that leans on its identity strengths, enforcing least-privilege for both human and machine identities, including the non-human identities that autonomous agents depend on. It detects shadow AI and provides posture checks with guided remediation, keeping AI risk inside the Falcon console teams already operate.

    Best for: enterprises on Falcon that want an AI posture tied to identity and endpoint context.

    5. HiddenLayer

    Leads on: model-layer security and adversarial testing.

    HiddenLayer specializes in securing the AI models themselves across the lifecycle, with model scanning, adversarial red teaming, and AI detection and response. It scans proprietary and third-party models for hidden risks, tests how well models withstand adversarial attacks, and covers AI supply chain risks across the MLOps pipeline. It fits organizations with mature machine learning teams whose deployed models are the assets they most need to defend.

    Best for: enterprises that need deep model-layer protection and adversarial resilience testing.

    How to Choose AI Attack Surface Platform?

    The AI attack surface has no single center, so the right platform depends on which layer a security team prioritizes, and many enterprises combine more than one. Teams focused on what attackers reach and exploit from outside, especially exposed MCP servers, shadow AI, and leaked AI credentials tied to a real attack path, land on CloudSEK AIVigil. Palo Alto Prisma AIRS fits enterprises wanting lifecycle coverage inside the Palo Alto stack, and CrowdStrike Falcon AI-SPM fits those standardized on Falcon. Wiz AI-SPM keeps posture in one graph for cloud-first teams already on Wiz. HiddenLayer goes deepest at the model layer for organizations whose deployed models are the asset they most need to defend. The practical pattern for most CISOs pairs external, attacker’s-eye monitoring of exposed AI assets with an internal posture or model-security layer, so the surface is covered from both directions.

    Frequently Asked Questions

    What is AI attack surface monitoring?

    AI attack surface monitoring is the continuous discovery, assessment, and monitoring of an organization’s AI assets and their exposure. It inventories AI systems, tests them for weaknesses such as prompt injection, and surfaces the exposures that represent real risk.

    How is AI attack surface monitoring different from AI-SPM?

    AI attack surface monitoring maps AI exposure from the attacker’s outside-in view, including internet-reachable assets and attack paths. AI security posture management (AI-SPM) assesses AI configuration and risk inside the cloud environment. Many enterprises run both.

    What is an initial access vector in AI systems?

    An initial access vector in AI systems is an entry point an attacker uses to reach an AI environment, such as an exposed MCP server, a public inference endpoint, leaked AI credentials, or a prompt injection flaw.

    How do you secure AI systems from prompt injection?

    Prompt injection is the top risk on the OWASP Top 10 for LLM Applications. Defense combines runtime guardrails on prompts and tool calls, external monitoring of exposed AI endpoints, and red-teaming that tests systems before deployment.

    What is shadow AI?

    Shadow AI is any AI tool, model, integration, or account an organization uses outside official approval or inventory. It expands the AI attack surface because security teams cannot monitor assets they do not know exist.

    How can enterprises identify attack paths before a breach?

    Enterprises can identify attack paths by correlating exposures, such as a leaked credential, an exposed AI asset, or a vendor weakness, into the chained route an attacker would take. Platforms like CloudSEK Nexus AI build these validated attack paths before a breach.