Lessons from information-security incidents explain how controls and response decisions can reduce risk and strengthen future cyber defenses.
Search across headline titles and summaries.
Background for this topic.
Lessons captures documented insights from security incidents, vulnerability disclosures, exercises, audits, and other operational experience—what happened, why defenses failed or worked, and what should change. The focus is not the event itself, but transferable understanding grounded in evidence, such as a missed patch, excessive privilege, weak recovery process, or detection rule that did not alert.
For practitioners, these accounts help turn failures into changes across the security lifecycle. A useful lesson identifies the affected asset and attack path, separates root causes from contributing conditions, and assigns verifiable corrective actions: reduce exposure through vulnerability management, improve logging and containment for incident response, or revise access and recovery controls. It should also state limits—an observation from one environment may not apply universally—and consider privacy and compliance when sharing technical or personal details. Readers should look for validated findings, measurable follow-up, and evidence that fixes remain effective, rather than treating a postmortem or case study as a checklist.
Weekly headline count for the current query.
Rising threats from third-party actors are forcing institutions to play defense to protect student data from ransomware and other attacks.
The fintech company's engineering-first application security team reengineered the process for granting system access, making it easier and more secure for developers working on their projects. Here are the lessons learned from Robinhood's experience.
The Maritime Transportation Security Act (MTSA) requires plans to protect OT systems, audits by independent third parties, and a hybrid OT-security role.
Discover how Franz Regul, former CISO for the Paris 2024 Olympics, tackled unique cybersecurity challenges to protect the Games from evolving threats.
Events and concepts from the Stranger Things television series illustrate how enterprises can defend their networks and stay "right side up."
Lessons from history highlight why AI-enabled browsers require controlled enablement.
The Nazi relic's history is riddled with resilience errors, and those lessons still apply to defending against modern cyber threats.
After two years of finding flaws in AI infrastructure, two Wiz researchers advise security pros to worry less about prompt injection and more about vulnerabilities.
Sara Duffer highlights the top lessons she brought back to her security role following three years in Amazon's shadow program.
To build an effective relationship with the CEO and the Board, CISOs must translate technical risks into business terms and position cybersecurity as a strategic business enabler rather than just a business function.
Jennifer Ewbank, former CIA deputy director of digital innovation, on resilience, cultural shifts, and cyber fundamentals in the AI era.
Sam Collins and Marius Muench of the University of Birmingham, UK, join the Black Hat USA 2025 News Desk to explain how anti-cheat systems in video games provide valuable lessons on defending against threat actors' techniques and strategies.
The lesson from the breach is not just about what went wrong — but what could have gone right.
McDonald's hiring platform was using its original default credentials and inadvertently exposed information belonging to approximately 64 million job applicants.
The ever-growing volume of vulnerabilities and threats requires organizations to remain resilient and anti-fragile — that is, to be able to proactively respond to issues and continuously improve.
Proactive defenses, cross-sector collaboration, and resilience are key to combating increasingly sophisticated threats.
High-profile security incidents provide examples of how common vulnerabilities can be exploited. If you pay attention, you can learn from others' mistakes.
The software supply chain is a growing target, and organizations need to take special care to safeguard it.
The lessons I've learned soaring through the skies have extended far beyond the runway.
A new report from the Open Software Supply Chain Attack Reference (OSC&R) team provides a framework to reduce how much vulnerable software reaches production.