Bitsight

Bitsight just wrapped up Luminate Exchange this week in London. Perhaps a bit of a contrarian take given the conversations in the broader cyber security industry right now, but I actually felt much more optimism than doom and gloom. Yes, AI-accelerated vulnerability exploitation is real and it's likely going to get worse before it gets better. But I saw real momentum on the defender side: AI enablement, richer signal collection, and a move toward intelligence-led, predictive risk management rather than just reacting to the next incident. I presented on expanding the intelligence picture into the extended supply chain and what more predictive, workflow-driven third-party risk management could look like in practice. More to come on that from Bitsight very soon! Big thanks to the Bitsight team for organizing such a great event, our speakers, and of course to our customers for sharing how they're thinking through these challenges. João Faria & team, Stephen Boyer Brian Mulligan Emma Stevens João Godinho Dor Gosher Miguel Reis B. April Loureiro, MBA #CyberSecurity #CTI #Bitsight #AI #CyberRisk #Mythos

Supply chain risk has become one of the biggest challenges security teams are navigating today. Very excited to see BitSight introduce Beacon — helping organizations gain deeper visibility into third-party exposure and act faster on emerging threats across their vendor ecosystem.

According to Wienerberger’s CISO, Bitsight delivered “an unprecedented amount of visibility” across their global IT landscape — a critical requirement for an organization operating 200+ sites in 28 countries with expanding third-, fourth-, and fifth-party dependencies. Their initial challenge was not a lack of data, but an excess of it. Large volumes of cyber risk signals obscured real exposures, making it difficult to prioritize action. Regulatory requirements under NIS2 and DORA further heightened the need for accuracy and continuous monitoring. By leveraging Bitsight’s external attack surface intelligence and supply chain risk insights, Wienerberger: • Identified previously unknown exposures • Accelerated remediation workflows • Improved supplier assessment quality • Increased confidence in supply chain resilience The data shows the impact: clearer prioritization, stronger vendor collaboration, and more reliable regulatory alignment. If you’re evaluating cyber risk across a distributed ecosystem, this case study provides a strong model for data-backed decision-making. https://ow.ly/RbGI30sVpvZ #CyberRiskAnalytics #ExternalAttackSurface #TPRM #NIS2Compliance #BitsightStory

According to Bitsight threat intelligence, attackers are systematically exploiting third-party vendors to scale supply chain access. Our analysis of 8.4 million threat-intelligence artifacts shows a clear pattern: • The most exploited third-party vulnerabilities are 8–20+ years old • They persist in shared infrastructure (DNS, hosting, browsers, remote access) • They enable attackers to expand blast radius across downstream organizations This is why traditional TPRM approaches fail. Questionnaires don’t reveal exposed infrastructure. Point-in-time reviews miss active attacker behavior. Threat-informed TPRM — combining continuous monitoring with real-world attacker intelligence — enables prioritization based on exploitation, not assumption. Full findings and implications for third-party risk leaders below. https://ow.ly/V6PE30sVAul #BitsightTRACE #CyberThreatIntelligence #ThirdPartyRisk #AttackSurfaceManagement #SupplyChainSecurity

One of the biggest misconceptions in cybersecurity right now? That more visibility = better security. In reality, most teams I talk to are already drowning in findings they can’t fully act on. Now layer in AI—and the ability to surface and exploit vulnerabilities at scale—and it’s clear the problem isn’t going away. It’s accelerating. This is exactly what Greg Keshian (CPO at Bitsight) gets into here—and why he’s pushing for a shift toward operationalizing resilience, not just identifying risk. The takeaway for me: It’s not about finding everything. It’s about knowing what actually matters. Curious how others are thinking about this shift. Read the full perspective: https://ow.ly/cu6r30sVh65 #Cybersecurity #RiskManagement #CISO #BitsightBlog

Operational resilience is under pressure—and most organizations aren’t as prepared as they think. Three Hard Truths About TPRM: What It Takes to Achieve Operational Resilience Join Julie Gaiaschi, CEO & Co-Founder, Third Party Risk Association (TPRA) and Vanessa Jankowski, SVP & GM, Bitsight TPRM, for a candid fireside chat on turning risk into readiness. What you’ll learn: • How to move from fragmented risk visibility to actionable resilience In nearly every conversation I’ve had with risk leaders lately, one theme keeps coming up: “We’ve checked the compliance box… now what?” Operational resilience is where things get real—and where many teams are still figuring it out. That’s why I’m looking forward to this upcoming Bitsight session. It’s focused on how organizations are actually putting resilience into practice: Translating policy into execution Using cyber risk data to guide decisions Building resilience that stands up to scrutiny If you're in the middle of this shift, you’ll get real value from this. Save your spot: https://ow.ly/B5Bz30sVe98 #BitsightWebinar #CyberRisk #TPRM #OperationalResilience

A lot has changed in how organizations think about cyber risk. This new Bitsight blog breaks down a key shift: moving beyond ratings as a benchmark to using them as a driver for action and measurable risk reduction. It also highlights why data quality, transparency, and context are becoming essential for security professionals who need to prioritize and act with confidence. Worth a read if you’re navigating these challenges today. https://ow.ly/GhRO30sV8M5 #CybersecurityStrategy #CyberRisk #RiskReduction #ThirdPartyRisk #InfoSec

The DORA deadline isn’t the finish line—it’s the starting point. Now comes the harder question: How do you prove operational resilience in practice? I’ve been hearing the same concern across teams—there’s a gap between compliance on paper and resilience in reality. This upcoming Bitsight webinar gets into that gap: • What regulators will expect next • How organizations are operationalizing resilience • Where cyber risk intelligence is shaping real decisions If you're navigating this shift, this is a timely session. Join us: https://ow.ly/9OPe30sV8rt #BitsightWebinar #CyberRisk #TPRM #OperationalResilience

⛓️💥 30% of data breaches stem from the supply chain. Looking after your own security is so so important, but ensuring you also are aware of the gaps and vulnerabilities in your supply chain is becoming just as important. Join 🕵 Terence Cheong from Bitsight as he dives into using Dark Web Intel alongside TPRM to transform how you prioritise threats and exposures within your supply chain! 30th of April at 1pm AEST