Database expert Dominik Tomicevic highlights the limitations of traditional cybersecurity defense methods and why knowledge graphs could be a better avenue for the CISO to pursue 

Data shows that the global cost of cybercrime will soar by four trillion dollars over the next four years, rising from $9.2 trillion in 2024 to an estimated $13.9 trillion by 2028. Does this mean organizations must simply accept cyberattacks, malware, phishing, and other threats as endemic and ever-growing challenges?

Not necessarily. Greater vigilance and innovation in cybersecurity strategies can change the trajectory. While embracing digital technologies and the cloud has undeniably boosted convenience and productivity, it has also introduced significant vulnerabilities. Increasing reliance on open-source libraries to speed development—rather than building all code in-house—has, in turn, exposed organizations to new and serious risks.

Traditional cyber methods don’t work anymore

But the benefits are simply too great to ignore. The drive toward digital, online, and cloud-based operations is unstoppable, as is the growing reliance on externally sourced or AI-generated code. The problem is that most current cybersecurity methods fall short because they rely on models that are too rigid—both in how they represent the world and how they adapt to change. This is where developers we work with have identified a better way to help curb these dangers, at least to some extent.

The reason current systems of record for cyber vulnerabilities often falter is that they are built on the relational data model, which functions much like a “phonebook.” A phonebook offers a static, alphabetical list of individuals—but real life is far more complex, shaped by friendships, families, workgroups, rivalries, and constantly evolving relationships. Static models simply can’t capture the dynamic nature of modern digital environments.

Attackers understand this. They don’t exploit static lists—they target the living, breathing web of human connections. In other words, they aren’t studying organizational charts or formal hierarchies; they focus on the real-world links between people, creeping through systems to exploit user permissions not in isolation, but as gateways into broader networks.

This is why social engineering is so effective. If one person is compromised, who else might be vulnerable? What systems do they access? Who do they interact with daily? Attackers are disturbingly good at tracing these pathways—and exploiting them to devastating effect.

There’s another key limitation with the phonebook model—or more technically, with traditional relational approaches to cybersecurity: speed. Moving fast is essential, but modeling real-world complexity with relational databases requires many JOIN operations, which quickly become computationally expensive. In a multi-step attack, it might take 10 to 20 JOINs just to assemble a clear picture, and by then, the process could either time out or consume so many resources that it becomes impractical.

Trying to defend against adversaries who map and exploit dynamic relationship networks is incredibly challenging. A bad actor can quietly slip in a change request to open port 40 in a cloud security configuration, and in a highly connected system, that single move could silently unlock 1,000 other doors—with no clear way of knowing where they are.

The key element in the security war is relationships

That’s not just a vulnerability. That’s a nightmare. What’s becoming clear is this: a better way to understand the complex relationships and interdependencies within cyberspace could not only strengthen defensive postures, but also enable faster, more decisive action.

In response, more and more organizations—whether protecting their own systems or building cybersecurity solutions—are turning to graph-based approaches to model relationships and information. After all, every employee’s access to business services and systems creates a connection—a relationship—between individuals and the resources they use.

Player No 2 has entered the game

Which is why graph technology matters: it models systems clearly and powerfully by representing users, systems, and data as nodes, and the permissions and connections between them as edges. This “graph thinking” isn’t new—it’s exactly how attackers view your environment during penetration testing. They don’t see a flat network; they see a connected web of relationships and look for paths they can exploit to move laterally.

Graph technology allows defenders to adopt the same perspective before threats emerge. At its core, graph technology is about relationships—and whether it’s employees and devices, users and applications, or systems and services, a graph database can accurately capture the complex way your organization truly operates.

Crucially, graph technology doesn’t just deliver better visibility—it also dramatically improves speed of response. Because graphs eliminate the need for complex queries and costly JOIN operations, problems can be solved on a linear, not logarithmic, timescale. Connections can be mapped in seconds, not hours, giving security teams the clarity and agility they need to stay ahead of threats.

So where does AI fit into this picture? The next natural evolution is leveraging machine learning, AI, and advanced data techniques. A graph-based approach not only strengthens cybersecurity today, it also lays a powerful foundation for future AI initiatives, enabling faster, smarter, and more adaptive defenses.

The potential of a graph-based approach to navigating the intricate network of relationships that underpin cybersecurity challenges is immense. However, without adopting smarter, more adaptive cybersecurity strategies, both businesses and society will continue to fall behind in the relentless battle against cyber threats—threats that often understand our systems and vulnerabilities better than we do ourselves.

The author is the CEO of knowledge graph leader Memgraph

The post It’s Time to Move Away from the “Phonebook” Approach to Cybersecurity first appeared on Cybersecurity Insiders.

The post It’s Time to Move Away from the “Phonebook” Approach to Cybersecurity appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/kDhscjp
via IFTTT

[Part 2 of 2 – Based on an interview with Zscaler CSO Deepen Desai]

By Holger Schulze, Cybersecurity Insiders

“Zero Trust isn’t a feature,” Deepen Desai told me during our RSA Conference interview. “It’s an architectural decision to stop trusting the network. You’re either enforcing that by design—or you’re pretending.”

In Part 1 of this series, we explored the failure of VPNs—how attackers exploit them, how they collapse under patching pressure, and how they expand risk instead of containing it. But our conversation in San Francisco didn’t stop at diagnosis. It turned toward what comes next.

The answer is Zero Trust. But not the watered-down, checkbox version.

“If your users connect and get placed on the network—even in the cloud—you’re not doing Zero Trust,” Desai said. “You’ve just moved your VPN to a new address.”

This isn’t about branding. It’s about architecture. And at Zscaler, that architecture is built on one foundational idea: attack surface reduction in the first place.

The Invisible Attack Surface

If the core flaw of VPNs is that they make applications reachable, then Zero Trust flips that completely. Desai described it as eliminating network presence altogether.

With Zscaler Private Access (ZPA), users never access the network. There is no IP assignment. No shared subnet. No inbound access to anything.

Instead, both users and applications establish outbound-only connections to the Zscaler Zero Trust Exchange. If identity, policy, and posture align, Zscaler stitches the user and app connections together.

“If you can scan the network, you’re on the network,” Desai said. “And if you’re on the network, the attacker can be too.”

This approach removes the need for VPN concentrators, inbound firewall rules, or exposed IPs. Applications go dark. And attackers can’t target what they can’t see.

The Philosophy That Replaces the Perimeter

At its core, Zero Trust is a framework built on three non-negotiable principles, defined by NIST and echoed in Zscaler’s architecture:

1. Never trust, always verify
   Every user, device, and workload must be authenticated and validated continuously—not just at login. Trust is not a location or a certificate. It’s earned, and it expires.
2. Enforce least-privilege access
   Users don’t need broad network access—they need specific access to specific applications, at specific times. Permissions should be as narrow as possible, always.
3. Assume breach
   Compromise is inevitable. The architecture must contain and isolate it. Lateral movement should not just be blocked—it should be impossible by design.

“Every one of those ideas breaks the legacy model,” Desai told me. “That’s why you can’t just rebrand your VPN and call it Zero Trust. It either enforces these tenets—or it doesn’t.”

At Zscaler, these principles are enforced not by firewalls, not by segmentation rules, but by the architecture itself. With ZPA, applications aren’t directly reachable, users aren’t on the network, and policies are enforced every time a connection is made.

From this foundation, the rollout begins.

The Four-Stage Shift to Zero Trust

Zscaler doesn’t advocate a forklift replacement of legacy systems. Instead, Desai laid out a four-stage adoption path—one that starts where the risk is highest and compounds benefit over time.

1. Secure Internet Egress with ZIA

Before private apps, start with outbound traffic. Zscaler Internet Access (ZIA) enforces consistent policy and TLS inspection across all users—without backhauling traffic to a central datacenter.

This removes the need for on-prem proxies and applies protection close to the user. It’s the foundation that makes the rest of Zero Trust scalable.

2. Replace Inbound VPN with ZPA

The next move is to eliminate VPN tunnels altogether. ZPA makes private applications invisible to the internet—no public IPs, no exposed services, no inbound firewall rules.

“It’s not just blocking access,” Desai said. “It’s removing the ability to even knock on the door.”

Access is determined by who the user is, what device they’re using, and what policy allows. Not where they’re connecting from or what network they’re on.

3. Segment User to Application Access 

This is where most organizations truly begin to understand the power of Zero Trust.

Instead of segmenting by subnet, VLAN, or NAC, Zscaler segments by user-to-app relationships. Policies are built around identity, not infrastructure. And Zscaler’s machine learning engine can detect real access patterns to suggest adaptive policies over time.

Desai shared one example where a customer believed they had 300 internal applications. Zscaler discovered over 10,000.

“You can’t segment what you don’t know exists,” he said. “But you also don’t have to do it all at once. Start with your crown jewels. Then isolate your riskiest users.”

That might include employees who routinely fail phishing simulations, users on unmanaged devices, or accounts showing anomalous behavior.

4. Trap the Attacker Before the Damage Spreads

Even with segmentation in place, breaches happen. But Zero Trust doesn’t stop at prevention—it extends into containment.

Zscaler integrates deception directly into the access layer: decoy applications, seeded with breadcrumbs, are presented to users just like real apps. If touched, access to the real environment is immediately revoked—and the attacker is isolated.

“They don’t even know they’ve been shut out,” Desai said. “But they’ve already lost.”

This eliminates the lateral movement that VPNs so often enable—and turns the attacker’s playbook against them. 

This is what makes Zero Trust more than prevention. It’s containment by design.

What Doesn’t Work: NAC and Cloud VPNs

Desai was unequivocal about what Zero Trust is not.

“Putting a VPN in the cloud doesn’t change what it does,” he told me. “If users still get placed on the network, you’ve changed the address, not the architecture.”

Network Access Control (NAC) solutions are equally limited. They may inspect device posture at the edge, but they can’t prevent what happens inside a session—especially if the attacker has valid credentials. They can’t block data exfiltration from within an approved connection. And they certainly can’t make applications invisible.

The Real Benefit: Simplicity That Scales

While the security benefits are clear, Desai pointed out that Zero Trust is also an operations win—especially for organizations struggling with VPN overhead.

According to the VPN Risk Report:

• 54% of security teams say VPNs cause recurring incidents
• 41% say they drain resources from higher-value projects
• ManpowerGroup cut 97% of remote access support tickets after moving to ZPA

“It’s not just your security team that benefits,” Desai said. “It’s your IT team. It’s your users. It’s your CFO who doesn’t want to keep buying concentrators or renewing patching contracts.”

When infrastructure goes away, complexity and resulting cost follows it out the door.

Making the Case to the Board

Desai wrapped our conversation with advice for CISOs working to bring Zero Trust to the boardroom. His recommendation: don’t talk about controls. Talk about containment.

“The question isn’t whether you’ll be breached,” he said. “It’s what happens next. VPNs let that breach spread. Zero Trust stops it where it starts.”

With VPNs, the breach spreads. With Zero Trust, the breach is contained—access is limited by default, and even successful compromise can’t move laterally.

Desai advises CISOs to lead with these three points:

1. Zero Trust shrinks breach impact
2. It scales with distributed users and cloud adoption
3. It replaces assumptions with proof—every time a connection is made

In a security climate where prevention is imperfect, containment is king.

A Shift That’s Already Happening

According to the 2025 VPN Risk Report, the transition is already happening. 65% of organizations are moving away from VPNs. 81% are investing in Zero Trust architecture.

This isn’t about buzzwords. It’s about control.

“VPNs make you reachable,” Desai said as we stood to leave. “Zero Trust makes your network and applications invisible to attackers. That’s the future.”

The post The End of VPNs — Part 2: Beyond the Buzz of Zero Trust first appeared on Cybersecurity Insiders.

The post The End of VPNs — Part 2: Beyond the Buzz of Zero Trust appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/pDOtJMx
via IFTTT

High-pressure incidents can be defining moments for organizations, demanding immediate, coordinated, and often high-stakes responses. In the realm of cybersecurity, where threats evolve rapidly and stakes include sensitive data, reputational damage, and financial loss, the pressure to act quickly is intense. While technical tools and expertise often take center stage in incident response, an equally critical and sometimes underestimated component is effective communication. As leadership expert Simon Sinek famously said, “Leadership is not about being in charge. It is about taking care of those in your charge.” In the heat of a cyber crisis, that care manifests through structured, empathetic, and timely communication that aligns teams, reduces confusion, and drives action.

This article explores practical communication strategies drawn from real-world incident response experiences to help security teams navigate the complexities of an active cyber crisis with clarity, calm, and confidence.

The Role of Communication in Cybersecurity Incidents

In cybersecurity, high-pressure incidents frequently involve fast-moving and complex threats such as ransomware outbreaks, data breaches, supply chain compromises, or insider threats. Each minute during an incident counts, delays in containment can amplify damage exponentially. The ability to communicate clearly both within technical teams and with non-technical stakeholders is crucial to mitigating impact and accelerating recovery.

Consider the handling of the 2020 SolarWinds supply chain compromise, often cited as a textbook example of effective crisis communication in cybersecurity. The victim organization faced a highly sophisticated attack that silently compromised thousands of customers. Rather than resorting to silence or obfuscation, the company published transparent, technically detailed blog posts outlining what was known about the attack, how it was being investigated, and practical mitigations customers could apply. Alongside public communications, internal teams maintained continuous updates and alignment across engineering, security, and leadership functions. This dual internal-external communication approach helped build customer trust and enabled rapid adoption of defensive measures, containing the damage faster than might otherwise have been possible.

Done right, communication transforms incident response from a frantic scramble into a coordinated, focused effort where everyone understands their role, priorities, and next steps. It establishes a rhythm and clarity that reduces panic, eliminates duplicative work, and enable swift decision-making.

Key Elements of Effective Communication During an Incident

Effective communication can make or break an organization’s response to a cybersecurity incident. The following core practices have proven vital in maintaining clarity, control, and confidence during high-pressure moments:

a. Structured Communication Cadence

One of the first lessons is to establish a predictable rhythm for communications. When uncertainty and chaos abound, a set cadence of updates brings much-needed stability. For example, during a ransomware outbreak at a global manufacturing company, the response team instituted two-hourly technical syncs where engineers shared progress on containment and forensics. Meanwhile, a separate briefing for executives occurred every four hours, providing strategic context and business impact summaries. This predictable cadence ensured tactical teams and decision-makers were aligned, and no critical information fell through the cracks.

Choosing appropriate communication channels and intervals is essential. For example, chat platforms work well for rapid-fire technical updates, while email or video calls suit broader leadership briefings. The key is consistency; team members should know when and where to expect updates.

b. Audience-Centric Messaging

Another fundamental principle is tailoring communication to the audience’s needs. Not all stakeholders require or want the same level of technical detail. For instance, during a cloud misconfiguration incident that exposed customer data, the security engineers needed detailed packet captures and logs to identify root causes and patch vulnerabilities. Meanwhile, the executive board required a concise summary outlining the incident’s impact, legal obligations, and remediation timelines.

In a real-world scenario, a financial services company experienced a similar breach where technical teams worked around the clock analyzing system logs and firewall rules. Simultaneously, the C-suite received simplified updates focusing on risk exposure, regulatory reporting deadlines, and customer notification plans. This bifurcated communication approach prevented information overload for executives and ensured engineers had the detailed data they needed to act decisively.

Crafting messages with clarity and purpose for each audience helps avoid confusion, reduces unnecessary alarm, and builds trust. Technical teams value accuracy and completeness, while leadership prioritizes business risk and next steps. Separating these messages and customizing tone and depth helps keep everyone informed and aligned without overwhelming anyone.

c. Cross-Functional Coordination

Cyber incidents ripple beyond the technical realm. They affect legal compliance, public relations, human resources, and customer experience teams. In a recent phishing attack targeting a multinational’s workforce, the incident response team ensured early involvement of HR to notify affected employees and assist with password resets. Legal counsel was looped in promptly to assess breach notification requirements under GDPR. Meanwhile, communications teams prepared customer-facing statements to manage external reputation.

Such cross-functional integration avoids conflicting messages, ensures regulatory compliance, and fosters a unified organizational response. Predefined roles and communication pathways, documented well before incidents occur, enable this coordination to happen smoothly under pressure.

d. Clear Escalation Paths

Time is the most precious resource during a cyber crisis, and ambiguity about decision-making authority can cost valuable minutes or hours. In one incident involving suspected data exfiltration, lack of a clear escalation matrix caused a six-hour delay before containment approvals were obtained. This delay extended the exposure window and increased damage.

Following that event, the company implemented a role-based decision tree that clearly defines who can authorize containment actions, legal escalations, or public disclosures at each incident severity level. This clarity reduced response latency in subsequent drills and real incidents alike, emphasizing the importance of predefined escalation paths in the communication plan.

e. Calm, Concise Communication Style

How information is communicated during a crisis influences team morale and effectiveness as much as what is communicated. During a distributed denial-of-service (DDoS) attack on a major retail platform, the incident commander kept all updates short, factual, and evenly toned, avoiding panic-inducing language. This steady tone helped the engineering teams remain focused on mitigation efforts without distraction, while leadership maintained a clear understanding of progress.

Training teams to communicate calmly and assertively rather than reactively or emotionally can significantly improve performance under pressure. Consistent messaging with a measured tone reduces misunderstandings and builds confidence in the response process.

Recap Putting Communication into Practice

To illustrate these principles, consider a mid-sized financial services company responding to a ransomware infection:

Structured Cadence: The incident manager set up hourly updates via group chat for technical responders, while business leaders received consolidated briefings every four hours via video conference.

Audience-Centric Messaging: Technical teams received detailed logs and mitigation steps, while executives got high-level summaries focusing on customer impact and regulatory notifications.

Cross-Functional Coordination: Legal and compliance teams joined briefings to advise on breach reporting timelines; customer support prepared scripts for incoming inquiries; HR alerted and supported affected employees.

Clear Escalation Paths: Predefined roles ensured that authorization for network isolation and public communications moved quickly from technical leads to CISO and then CEO without delay.

Calm, Concise Style: Incident communications remained steady and factual, avoiding speculation or alarmist language, which helped maintain team focus and stakeholder confidence.

This integrated communication approach allowed the company to contain the attack within 24 hours, minimize business disruption, and meet all regulatory obligations on time.

Conclusion

Senior engineering leaders must recognize that communication is as vital as the technical response during incidents. Clear, timely, and targeted communication helps contain threats, reduces confusion, and enhances decision-making. Structured updates, predefined escalation paths, and cross-functional alignment transform chaos into coordinated action. The tone and clarity set by leaders directly influence team performance under pressure. Communication is infrastructure, not just support, and must be woven into incident response plans to safeguard systems and maintain organizational trust.

 

 

The post Engineering Calm in Crisis: Lessons from the Frontlines of Security first appeared on Cybersecurity Insiders.

The post Engineering Calm in Crisis: Lessons from the Frontlines of Security appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/SeHnrcN
via IFTTT