Policy on Jorge Laurel

Vulnerability Exploitation Is Moving Faster. What the 2026 Time-to-Exploit Data Shows

Fri, 26 Jun 2026 16:46:24 +0000

Average time from vulnerability disclosure to working exploit has dropped from roughly 125 days in early 2025 to under a day by April 2026, across an analysis of approximately 69,000 CVEs. Some vulnerabilities are now exploited before patch advisories are published. The assumptions most patch management processes were built on may no longer hold.

For most of the last two decades, vulnerability management rested on a quiet assumption: between the moment a flaw became public and the moment an attacker could use it at scale, defenders had a usable buffer. Days, often weeks. Enough time to test, stage, and deploy a patch or patches. A lot of process was built on top of that buffer.

Strengthening Cybersecurity: The Power of Public/Private Partnerships

Sat, 03 May 2025 14:52:39 +0000

Cybersecurity threats don’t respect boundaries—so why should our solutions?

When protecting critical infrastructure—such as power grids, transportation networks, healthcare systems, water supplies, and financial institutions—no single organization can tackle the challenge alone. This makes public-private partnerships not just beneficial, but absolutely essential for safeguarding our societies.

Why Are Partnerships Necessary?

Government agencies bring authority, resources, and oversight to set regulations, establish security standards, and coordinate broad responses. However, it’s the government and agencies and departments often face bureaucratic delays that slow implementation. Meanwhile, private companies can be more agile and innovative, quickly adopting advanced technologies. But without the legal authority or network reach of public entities, their efforts can struggle to scale up nationwide or across borders.

Did you really read the Terms of Service before installing that app?

Thu, 01 Aug 2024 14:00:00 +0000

In the digital age, social media apps have become an integral part of daily life, offering connectivity, entertainment, and a platform for self-expression. However, the convenience of these apps comes with significant cybersecurity risks. While ALL social media platforms, or any app that you install, pose some level of risk, these dangers are heightened when the company that created the app is based in a country that can compel it to hand over user data.

Defense Industrial Base Cybersecurity Strategy for 2024-2027: An Overview

Sun, 31 Mar 2024 20:57:00 +0000

The Department of Defense (DoD) has unveiled its ambitious Defense Industrial Base (DIB) Cybersecurity Strategy for Fiscal Years 2024-2027. This forward-looking strategy lays out a detailed roadmap to strengthen cybersecurity and cyber resiliency within the DIB, aligning closely with overarching national defense and cybersecurity strategies. At the heart of this strategy is a multilayered approach to enhancing governance structures, boosting cybersecurity postures, ensuring the preservation of critical capabilities in cyber-contested environments, and fostering improved collaboration across the DIB.

Beyond the Perimeter: Advancing Zero Trust Maturity with Network and Environment Strategies

Sun, 10 Mar 2024 15:00:00 +0000

On 5 March 2024, the National Security Agency (NSA) issued a Cybersecurity Information Sheet (CSI) titled “Advancing Zero Trust Maturity Throughout the Network and Environment Pillar” aimed at enhancing network defenses by restricting adversaries’ lateral movements. It emphasizes the necessity of adopting a Zero Trust framework, which includes rigorous internal network controls and segmentation to prevent unauthorized access to critical data and systems.

NSA Cybersecurity Director Rob Joyce highlighted the importance of recognizing internal threats and actively countering potential breaches by stating “Organizations need to operate with a mindset that threats exist within the boundaries of their systems. This guidance is intended to arm network owners and operators with the processes they need to vigilantly resist, detect, and respond to threats that exploit weaknesses or gaps in their enterprise architecture.”

Small Targets, Big Impact: Why Securing SMBs is Critical for National Security

Sun, 18 Feb 2024 15:00:00 +0000

As digital transformation reshapes the economy, safeguarding critical infrastructure has become vital. Critical infrastructure refers to systems essential for societal and economic operations, now frequently targeted by cyber threats. Adversaries recognize the strategic value of critical infrastructure and exploit vulnerabilities to disrupt services, steal sensitive data, or cause chaos.

Despite their size, the role of small to medium-sized businesses (SMBs) in protecting this infrastructure is often underestimated yet it is critical in the broader strategy to defend against these threats. SMBs are key players in this defense against state actors, cybercriminals, and activists. Recognizing and enhancing SMBs’ role is fundamental to a comprehensive defense of our interconnected digital landscape.

Fortifying Critical Infrastructure: The Open-Source Software Security Imperative

Sun, 04 Feb 2024 15:00:00 +0000

In our digital age, securing critical infrastructure must be THE key focus, given its foundational role in national security, economic stability, and public safety. For the past several months my team and I have been involved with the Open-Source Software Security Initiative (OS3I). The OS3I convenes Federal agencies and considers input from the open-source software community, civil society, and private sector stakeholders across the open-source software landscape to deliver policy solutions to secure and defend the open-source software ecosystem. This initiative underscores a collaborative effort to fortify the backbone of our society against escalating cyber threats, leveraging the collective expertise and innovation inherent in the open-source community to ensure a resilient and secure infrastructure for the future.