Archive

Center for Advancing Cybersecurity

Reshaping and realigning incentives in the technology ecosystem to advance the delivery of resilient and secure services

June 30, 2026 11:00 am

Contractors at the Keyboard? Private Offensive Cyber Operations Authorities in the FY2027 Senate NDAA

Defense contractors play a vital role in U.S. national security, but do not currently execute "hands-on-keyboard" cyber operations. That role might be about to change with the Senate-reported NDAA for FY2027. On Tuesday, June 30, IST and friends had a discussion on the implications of this potential shift.

cyber command, cyber offense, cyber operations, defense contractors, national security, NDAA, offensive cyber

June 30, 2026

Exercice de simulation de l’Initiative de lutte contre les rançongiciels: Rapport après action

L'Institute for Security and Technology (IST), en partenariat avec le Department of Home Affairs de l’Australie et le Groupe consultatif du secteur privé sur l’Initiative de lutte contre les rançongiciels (ILR), dirigé par Sécurité publique Canada et BlackBerry, a organisé un exercice de simulation multinational sur les rançongiciels pour voir comment les intervenants des secteurs public et privé se coordonnent lors d’un incident important.

coordination, counter ransomware initiative, cyber, cybersecurity, disruption, information sharing, operational collaboration, Ransomware, Singapore, tabletop exercise

June 24, 2026

Last Mile Cybersecurity

Federal funding bills rarely require cybersecurity for the infrastructure they finance, even as adversaries target U.S. water systems, power grids, and government networks. "Last Mile Cybersecurity" outlines concrete policy fixes to close that gap.

critical infrastructure, cybersecurity, energy, grants, national security, OMB, public funding, resilience, risk-mitigation, water

June 22, 2026

June 17, 2026 8:00 am

Critical Effect 2026

Presented by ICS Village, in partnership with IST’s UnDisruptable27 project and Akin, the two-day Critical Effect conference returned to Washington, DC on June 17 and 18. With 2027 getting closer, we prioritized ideas that lead to real, actionable impact.

critical infrastructure, energy, healthcare, national security, public safety, resilience, Volt Typhoon, water

June 16, 2026

Driving AI Transparency: Supply- and Demand-Based Paths Toward AIBOM

Understanding AI systems’ technical DNA is crucial to ensuring trust, resilience, and risk management. A new policy memo makes the case for establishing a shared vision of Artificial Intelligence Bills of Materials (AIBOMs).

artificial intelligence, bill of materials, critical infrastructure, cybersecurity, demand, resilience, risk management, supply, supply chain

June 16, 2026

June 8, 2026 10:30 am

A Policy Response to the Mythos Moment: Breaking down the AI and Cybersecurity EO

What does the newly-released AI and cybersecurity Executive Order mean for cyber defenders? How does it respond to the "Mythos moment"? On June 8, IST hosts a pop-up webinar to explore these questions and more.

artificial intelligence, critical infrastructure, CVE, cybersecurity, Executive Order, national security, vulnerability disclosure

June 5, 2026

Rapid Reaction: IST Experts on the Artificial Intelligence Executive Order

Team members from across IST’s artificial intelligence security portfolios shared their initial thoughts on what the Trump administration's Executive Order on artificial intelligence gets right, where there is room for improvement, and how it stands to impact the AI ecosystem and AI security more broadly.

AI, artificial intelligence, cyber, data poisoning, frontier AI, LLMs, security, vulnerability disclosure

June 2, 2026

UnDisruptable27 Newsletter: “The threat comes from cyber, but the solutions come from engineering. It’s not shields up. It’s connections down.”

In the latest edition of the UnDisruptable27 newsletter, the team reflects on Josh's testimony before Congress, surfacing some of the most surprising takeaways, key insights from his fellow witnesses, and what the community can do next.

cascading failures, congress, critical infrastructure, cyber-informed engineering, cybersecurity, risk reduction, water, water utilities

May 28, 2026

Episode 52: Kindness and Critical Infrastructure: Rethinking OT Security

“Security is not convenient. Nobody likes change. But at the same time, we have to be secure. Finding that middle ground is the challenge in my position.” In Hack the Plan[e]t episode 52, "Kindness and Critical Infrastructure," Andrea Haddad sits down with host Bryson Bort to discuss how to rethink OT security.

authentication, critical infrastructure, cybersecurity, firewall, IT, network security, OT, remote access

May 27, 2026

Testimony: Research-Driven Resilience: Applying Science to Secure U.S. Water Systems from Cyber Threats

IST Executive in Residence Josh Corman testified before the House Committee on Science, Space, and Technology's Subcommittee on Environment in a hearing on efforts to protect the nation's drinking water and wastewater systems from growing cyber threats. “Attacks on water utilities can start affecting worsened outcomes and even loss of life within minutes for heart conditions,” he said.

cyber threats, cybersecurity, UnDisruptable27, Volt Typhoon, water, water system

May 22, 2026

May 21, 2026 2:00 pm

Hearing: Research-Driven Resilience: Applying Science to Secure U.S. Water Systems from Cyber Threats

On May 21, 2026, UnDisruptable27's Joshua Corman testified before the House Science, Space, and Technology's subcommittee on Environment to share lessons learned on protecting U.S. water and wastewater from cyber threats.

congress, cyber-informed engineering, cybersecurity, public safety, resilience, science, water utility

May 19, 2026

Cyber Redlines and China: Taking Advantage of the Trump-Xi Meeting

Chinese military hackers known as Volt Typhoon are pre-positioning in U.S. power grids, water plants, and transportation systems. In a new op-ed, Elizabeth Vish makes the case that finally getting Chinese hackers out of U.S. critical infrastructure should start at the Trump-Xi meeting, but it can’t end there.

China, cost imposition, critical infrastructure, denial, deterrence, National Cyber Strategy, redline, Russia, sanctions, Trump, Xi

May 14, 2026

May 14, 2026 3:30 pm

When the Classroom Gets Hacked: Securing Schools Before the Next Breach

A massive breach just hit more than 8,800 schools, exposing students' private data as millions of students prepare for final exams. Join RSAC and IST to discuss how to protect "target rich, cyber poor" institutions before the next attack.

cybersecurity, data breach, education, k-12, schools

May 14, 2026

Progress Report

The Ransomware Task Force at 5 Years: Progress… and Backsliding

As we mark the fifth anniversary of the release of the RTF report and its 48 recommendations, IST’s cyber experts took time to reflect on each of the 4 pillars, note where they’ve seen improvements since 2021, and track where progress has slowed–or even taken a step back.

blueprint, cybercrime, deter, disrupt, prepare, Ransomware, respond, RTF

April 30, 2026

April 30, 2026 11:00 am

Dark Screens: The Ransomware Task Force at 5 Years

This week marks 5 years since the launch of the Ransomware Task Force. It’s also the official U.S. launch of the book, "Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware." Join author Anja Shortland for a panel discussion with RTF Co-Chairs on what's changed, and what hasn't.

cybercrime, data extortion, deter, disrupt, hackers, prepare, ransom payments, Ransomware, respond

April 30, 2026

UnDisruptable27 Newsletter: Is Secure-By-Design too late for Lifeline Functions? What can be done, for whom, by when?

Is it too late for secure-by-design? That provocative question was at the heart of our presentation at the RSAC Conference this year. In UnDisruptable27's latest newsletter, we recap their mock debate, concluding that even though the best time might have been years ago, the second best time to implement secure-by-design is now.

April 27, 2026