ECSO CISO Meetup draws record turnout in Berlin
More than 230 cybersecurity leaders met at Estrel Berlin on 1–2 October for the fifth ECSO CISO Meetup. The next edition follows in Warsaw in 2027.
SecurityToday - The security briefing for IT decision-makers
The Briefing/Critical vulnerabilities · 14 days/Actively exploited/0 new · 7 days
Threat Trend
Critical vulnerabilities · 14 days7
1
9
2
0
0
6
9
3
2
4
3
7
8
Wed
Fri
Sun
Tue
Thu
Sat
Today
Actively exploitedCritical (CVSS ≥ 9)
Source: CISA KEV · NVD · As of 02.11.2026
Our analysis
Practice & Implementation
All articles
Attacker accounts remain active after the Artifactory patch
Admin accounts, backdoors and remote access services survive the update. Attacks on Artifactory and PaperCut show what still needs to be checked after patching.
Rehearse the IT outage before no one is left to decide
Two hours analog, fixed roles and an annual calendar let you rehearse a real outage before operations stop.
N-central: Remote takeover possible without a patch
CISA lists CVE-2026-86218 as exploited since September 8. Build 2026.3.1.14 fixes the N-central server flaw; self-hosted systems need Hotfix 4.
Strategy & Governance
All articles
Cyber insurance: lack of evidence puts the policy at risk
Underwriters require reliable evidence of security controls. False statements about MFA, endpoint protection or backups can jeopardise coverage.
A CISO does not take responsibility away from company leadership
Matthias Muhlert, Chair of the ECSO CISO Community, ahead of the ECSO CISO Meetup 2026 in Berlin on board responsibility, metrics, suppliers and AI …
Nvidia Wants to Stop Breakout AI Agents via Hardware
Nvidia shifts control of AI agents into runtime and hardware. The Sentry component for BlueField-4 remains a reference design for now.
Case Studies
All articles
Northern German Workshop Adopts DataManagement as a Service for M365 Backup from Pink Elephant
M365 Backup via DataManagement as a Service: A social institution uses Pink Elephant for data backup, recovery and German hosting.
DORA in Practice: First Experiences from the Financial Sector
DORA has been fully applicable since January 17, 2025. After the first few months, it is clear: The technical requirements for ICT risk management, …
Why Every Relaunch Needs a Security Audit – Lessons from 50 Web Projects
Over 50 web projects - each post-launch audit found vulnerabilities. Open admin accesses, forgotten staging servers, standard passwords. A relaunch without a security check …
Most Read
- 01
- 02
- 03
- 04
- 05
Security Glossary
All termsKey security terms explained in a compact, citable format: definition, context and the questions that keep coming up.
NIS2
The EU directive that turns cybersecurity into a boardroom matter for thousands of companies. Who it covers and when evidence falls due.
Read the entry →
DORA
The resilience standard for the financial sector. Which artefacts the regulator wants to see and who shares liability in the supply chain.
Read the entry →
Zero Trust
No device and no user is trusted automatically. What the principle really means in daily practice.
Read the entry →
Ransomware
Extortion through encryption, increasingly even without it. How a modern attack unfolds and what stops it.
Read the entry →
Passkey / FIDO2
The passwordless login, bound to device and biometrics. Why it pulls the ground out from under phishing.
Read the entry →
Post-quantum cryptography
Encryption that holds up even against the quantum computer. Why the transition starts now.
Read the entry →
