Archive

Center for Advancing Cybersecurity

Reshaping and realigning incentives in the technology ecosystem to advance the delivery of resilient and secure services

Misaligned incentives are driving technology suppliers, buyers, and operators to undervalue security, leaving our critical infrastructure exposed and putting national security at risk. The Center works to realign those incentives before the problem outpaces our ability to solve it.

The National Vulnerability Database in an Age of AI: IST and the Software Safety Institute respond to Request for Information

AI-driven threats are outpacing traditional vulnerability management strategies. In August, NIST published a request for information on modernizing the National Vulnerability Database. In their response, Nick Leiserson, Bob Lord, and Lauren Zabierek offer four structural changes to rebuild the CVE ecosystem.

Common Vulnerabilities and Exposures, CVE, National Vulnerability Management Program, NIST, software, vulnerability identification, vulnerability management

October 19, 2026

Building an Interoperable HBOM Ecosystem for Energy Sector Supply Chain Security

Hardware supply-chain security is national security, particularly when a compromised component can threaten the resilience of the power grid. Securing complex bulk-power and other critical infrastructure systems requires visibility into all the underlying components. In a policy memo, Allan Friedman and Nicholas Leiserson make the case for Hardware Bills of Materials as an essential foundation of real grid resilience.

bill of materials, bulk power, critical infrastructure, cybersecurity, demand, energy, grid resilience, national security, resilience, risk management, supply, supply chain

October 15, 2026

Episode 54: Securing What Feeds Us

“There is so much tech in our food and agriculture industry now that is touching our food on some level… we are creating the potential for a foodborne illness to happen from a cyber attack.” Hack the Plant host Bryson Bort sits down with Kristen King, host of the Bites and Bytes podcast, on why food and agriculture remain a dangerously overlooked piece of critical infrastructure.

critical infrastructure, cybersecurity, food security, ICS, OT

October 14, 2026

The Clear, the Muddy, and the Insoluble of the Administration’s Cyber Operations National Security Presidential Memorandum

The administration’s Cyber Operations National Security Presidential Memorandum (NSPM) sets out to enlist private contractors to execute offensive cyber operations against foreign criminal networks. But C-suite executives at companies with the ability to act at scale aren’t likely to take up operations that carry ill-defined legal and operational risks, writes Leonard Bailey.

contractors, cyber crime, cyber operations, cybersecurity, legal authority, national security, NSPM, offensive cyber, operational risk

October 9, 2026

AI-Powered Cyber Threats Further Exposing Society’s Fragile Foundations

AI-powered cyber threats are increasingly exposing the vulnerabilities in our critical infrastructure systems. For Claroty Nexus, IST Center for Advancing Cybersecurity President Nicholas Leiserson argues we can narrow the gap between malicious actors and cyber defenders with efforts like IST’s Fragile Foundations Sprint.

AI, artificial inteligence, critical infrastructure, cyber threats, cybersecurity, Fragile Foundations

September 30, 2026

E-Rate: A Lifeline With a Blind Spot

While schools across the country have become a popular target for malicious actors, they still lack the cybersecurity resources to defend themselves. In this webinar, IST brought together members of the Future of Universal Service Fund Reform Task Force, including former FCC staff and education industry leaders, to unpack their recommendations for the next evolution of the E-Rate program.

critical infrastructure, cybersecurity, E-Rate, K-12 Education, Universal Service Fund

September 23, 2026

September 14, 2026 3:00 pm

E-Rate: No Connectivity Without Cybersecurity

As schools face increasing cyber threats, the Future of Universal Service Fund Reform Task Force has issued recommendations for Congress to consider in the rewriting of the E-Rate Program. IST’s experts hosted this webinar with members of the task force to discuss their recommendations, the FCC’s cybersecurity pilot, and the broader context of E-Rate reform.

cybersecurity, E-Rate, Universal Service Fund

September 14, 2026

Between a Breach and a Hard Place: IST’s Michael Klein on the Canvas Leak

Three months after IST’s Michael Klein coordinated state leadership in response to the Canvas breach, Klein reflects on navigating a situation which, due to the lack of federal capacity and authority, left him feeling like “one person holding together a sector.” But what can feel like an overwhelming task for one person actually represented the powerful collaboration of K-12 Cyber Defense Coalition members from across the education & cybersecurity communities.

critical infrastructure, cybersecurity, data breach, education, Ransomware, school, ShinyHunters, university

September 10, 2026

February 4, 2027 6:00 pm

Fourth Annual Cyber Policy Awards

On the evening of Thursday, February 4, 2027, IST will host the Fourth Annual Cyber Policy Awards™ Gala in Washington, DC. During the event, members of the cyber policy community will present The Atlas awards to deserving recipients who have driven meaningful progress over the last year, along with a special award for Lifetime Achievement.

awards, cyber policy, gala

September 9, 2026

Episode 53: From DC to Sacramento: Building Resilient Critical Infrastructure and OT Workforces

“Securing critical infrastructure is not one person’s job. You bring multiple people, multiple teams with different expertise to come together.” Hack the Plant is back for season 6! In this special premiere episode, our host Bryson Bort sits down with IST’s Josh Corman, Clutch’s James Regan, and Palto Alto Network’s Adam Robbie.

Critical Effect DC, critical infrastructure, cybersecurity, IT, OT

September 9, 2026

Inside the Presidential Memorandum on Transnational Cyber-Enabled Crime

IST friends and experts hosted a pop-up webinar to examine the recent presidential memorandum on combating transnational cyber-enabled crime. Featuring Jen Ellis, Jason Kikta, Leonard Bailey, Nicholas Leiserson, and Megan Stifel, the discussion covered the ethical, strategic, and legal implications of deputizing private companies to carry out these operations.

cyber crime, Cyber Strategy, cybersecurity, offensive cyber

August 27, 2026

IST Launches the Fragile Foundations Sprint to Confront AI Cyber Disruption to Life Safety Critical Functions

IST is convening the Fragile Foundations Sprint, developed by Joshua Corman and led and coordinated by Jen Ellis and David Batz, to lay the groundwork for pragmatic guidance and future action to strengthen the resilience of critical infrastructure against AI-powered cyber threats.

artificial intelligence, critical infrastructure, cybersecurity, Industrial Control Systems, Operational Technology

August 27, 2026

August 24, 2026 10:30 am

Exploring the Presidential Memorandum on Combating Transnational Cyber-Enabled Crime

A Presidential Memorandum this month changed the role of private companies in U.S. cyber operations. On Monday, IST’s cybersecurity and legal experts will sit down for a pop-up webinar to discuss the implications of the Memorandum and debate what may be covered under "cyber-enabled crime."

Cyber Strategy, cybercrime, cybersecurity, offensive cyber

August 24, 2026

Mexico Ransomware Task Force highlights value of disrupting criminal infrastructure, commits to public awareness campaign

In Mexico City today, the 40+ members of the México Ransomware Task Force endorsed a set of actionable recommendations for the Mexican multistakeholder community to combat the threat of ransomware.

critical infrastructure, cybersecurity, digital economy, Mexico, Ransomware, Ransomware Task Force

August 13, 2026

Two Sandbox Escapes, One Coalition, and 622 Patches: Vulns + AI = Oh My!

From the OpenAI breakout to Microsoft’s record-breaking Patch Tuesday surge, AI is reshaping both offense and defense across the cybersecurity landscape. In IST’s July 31 webinar, “Vulns + AI = Oh My! From Sandbox Escapes to Record Patches,” five experts cut through the noise, headline hype, and press releases to figure out what’s happening on the ground.

AI, CISA, Microsoft, OpenAI, patching, software, vulnerability

August 5, 2026

An Undeclared War: UnDisruptable27, Critical Infrastructure Systems, and Cyber Threats at Critical Effect DC ‘26

Presented by ICS Village in partnership with IST’s UnDisruptable27 project and Akin, Critical Effect DC ‘26 brought together leaders across operational technology, industrial control systems, national security, and public policy, with a sharp focus on safeguarding human life and essential services.

critical infrastructure, energy, healthcare, national security, public safety, resilience, Volt Typhoon, water

August 4, 2026