A False Sense of Cyber Security: Measure What Really Matters
#Recorded on November 24th 2025 Cybersecurity confidence is soaring. According to a new industry-wide survey, 71% of organizations believe their readiness program is "very" or "extremely" mature, and nearly all feel they can effectively handle an incident. But what if that confidence is more fiction than truth? Our 2025 Cyber Workforce Benchmark Report, combining external survey findings with performance data from millions of real-world exercises, reveals a troubling disconnect. While organizations feel prepared, our data shows resilience scores and incident response times have flatlined year-over-year. This stagnation suggests there is a dangerous gap between perceived readiness and actual capability. Join Immersive Founder and Chief Innovation Officer, James Hadley, former Barclays CISO, Oliver Newbury, and Immersive Senior Director of Cyber Resilience, Dan Potter, as they unpack the critical findings from our 2025 report. They will provide a candid, data-driven diagnosis of why progress has stalled and offer a practical perspective on how to build a truly resilient workforce. You'll learn about: The Readiness Rut: Why practicing outdated threats and exercising in functional silos has stalled performance. The Tooling Trap: How a false sense of security from technology can mask poor accuracy rates in real-world scenarios. The Experience Gap: See why managers and non-technical users are engaging more with AI threats than seasoned technical experts. From Insight to Action: Get a CISO’s insight on how to build a truly measurable, people-centric defense that proves readiness.
CVE-2022-26134 (Confluence) – OGNL Injection
For Question 6. Look at the first exploit attempt by this attacker. What command did they run? I am wondering about why when sharing the commands found in the logs, it still outputs wrong. even if typing in "X-Cmd-Response" as the command as well as the entire string found. Wondering if they are exepecting a different format/snippet of the code, or the GET requests instead?
ISO 27001 and the Immersive One Platform: Strengthening Your Information Security Posture
The importance of continuous evidence When audits or investigations happen, it’s not enough to say you’ve got things under control – you need to prove it. That means having solid evidence of your security posture, how it’s been implemented, and a continued commitment to it. Without that, the risk of fines and reputational damage goes up. Being able to demonstrate continuous evidence is crucial for staying in line with the latest directives and regulations. How Immersive can help Immersive helps organizations implement compliance frameworks like ISO 27001 by providing evidence of due diligence, simplifying the human element of security, and enabling gradual expansion of security measures. Depending on your priorities, or where you perceive your biggest gaps to be, these are some of the areas you can leverage in the Immersive platform: Improving the speed and quality of response to emerging threats. Increasing efficacy in recruitment, retention, and career development. Reducing cloud and application vulnerabilities early in the Software Development Life Cycle (SDLC). Here are three practical ways Immersive supports ISO 27001 compliance: 1. Hands-On Labs These labs ensure people across different roles get the right training and skill development. Security and technical teams have varying needs, and our labs help meet those needs by aligning practical learning to specific job functions. A general theme is how failing to provide proper training isn’t just a missed opportunity – it can be seen as negligence. An organization is responsible for providing training tools, which should be aligned with specific roles. Here are some of the ISO 27002 sections that our Hands-On Labs align with: 5.4, 5.7, 6.1, 6.3, 8.7, and 8.27. For more details, see the ISO 27002 implementation guide. 2. Crisis Sim All frameworks emphasize properly exercising staff and those with decision-making responsibilities. This covers everything from traditional tabletop exercise (TTX) at the board level to hands-on scenarios for teams further down the organization. Proving these exercises are happening effectively can be challenging. Traditional exec-level sessions are expensive, time-consuming, and hard to scale. Crisis Sim helps to solve this. It offers a practical, scalable way to run structured exercises across different teams and roles, including the supply chain. Here are some of the ISO 27002 sections that our Crisis Sim solution addresses: 5.4, 5.20, 5.24, 5.34, and 8.16. For more details, see the ISO 27002 implementation guide. 3. Workforce Plenty of areas in the ISO 27001 framework apply to the entire organization, not just technical teams. In some cases, we already have content such as labs and workforce exercises that can be used right away. But often, the focus is on your own internal policies and procedures – and that’s where our customizable templates and lab-building tools come in. The Immersive Workforce methodology gives you a structured way to train your people and show that they truly understand and can apply those policies in real-world scenarios. It’s all about making security awareness practical, measurable, and tailored to your organization. Our Workforce methodology meets the following ISO 27002 sections: 5.10, 5.17, 5.27, 5.34, 6.3, 6.7, and 8.1. For more details, see the ISO 27002 guide. Turning compliance into confidence By tapping into the full power of the Immersive platform, organizations can go beyond just checking compliance boxes. They can actively show due diligence, streamline compliance efforts, and proactively strengthen their information security posture. From hands-on training and crisis simulations to workforce assessments, Immersive provides the tools and methodologies needed to ensure that individuals at all levels are equipped to understand, apply, and uphold robust security practices. Ultimately, this leads to a more secure environment, reduced risk, and clearly demonstrates an organization's commitment to protecting its valuable information assets. Share your thoughts How is your organization approaching ISO 27001 compliance? Drop a comment below and let us know what’s worked, or what you’re still figuring out. For more details on strengthening your information security posture, check out these sources: ISO 27001 framework ISO 27002 implementation guide (for ISO27001) NIS2 DORAPractical Malware Analysis: Static Analysis question 19
for what native Microsoft service is this malware trying to masquerade as with a legitimate seeming name and a reference to a file path that can be used for persistence, for some reason when typing down the Microsoft Security Center (2.0) Service name, and the info gained from and the registry path HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. it keeps saying that it is wrong. I am wondering about what format are they expecting an answer? or if I am using the wrong name. as mssecsvc2.0 is also wrong.Is Your Team Really Ready for a Cyberattack? (Prove It, Don't Hope It)
Cyberattacks are increasingly frequent and sophisticated. According to the Identity Theft Resource Center (ITRC)’s 2024 Data Breach Report, they remain the primary root cause of data breaches, with Financial Services replacing Healthcare as the most targeted industry. The message is clear: no organization is safe. The recent breach at Change Healthcare/UnitedHealth Group, which exposed the health data of around a third of Americans, shows that the scope of modern cyberattacks extends beyond individual organizations. This isn't just a data breach; it's proof that a single vulnerability can disrupt healthcare operations, impact patient care, and erode public trust. Building a cyber-ready workforce isn’t optional – it’s essential. This isn't about hoping you're prepared; it's about proving it. What "cyber-ready" means in practice A cyber-ready workforce goes beyond having an IT security team. It means everyone, from the front lines to the C-suite, understands their role in preventing and responding to cyber threats. First-line responders (IT security, SOC analysts): These are your digital defenders, constantly monitoring threats. But they're not just monitoring alerts; they're dissecting the attack, isolating the threat, and preserving digital evidence like detectives on a case. They react instantly to alerts, following incident response procedures to identify and contain attacks, aiming for rapid isolation to limit damage. Mid-level managers (team leads, department heads): These are your field commanders during a crisis. They're not just relaying information; they're making tough calls under pressure, coordinating teams, and ensuring everyone stays focused on the mission. They escalate issues to senior leadership and keep all stakeholders informed. Senior leadership (C-Suite, board members): These leaders understand that cybersecurity is a core business risk, not just an IT problem. They champion a security-first culture, prioritize cybersecurity investments, and understand a breach's potential financial, legal, and reputational fallout. The cost of being unprepared: a ripple effect of damage Think about the impact of a successful cyberattack on your customers, your employees, and your reputation. It's not just numbers on a spreadsheet; it's real-world consequences. Imagine the chaos: systems down, customer data compromised, the phone ringing off the hook with angry clients. The financial costs are staggering, with IBM’s Cost of a Data Breach report stating the average data breach now costs $4.45 million, and that number increases yearly. Then comes the reputational damage: lost customer trust, negative press, and long-term brand erosion. Operations stall, workflows are disrupted, and productivity plummets. Legal fees, regulatory fines, and the potential for crippling fines for non-compliance with laws like GDPR, HIPAA, and DORA add further strain. It's a domino effect that could threaten your organization’s survival. Building effective response through cyber drills and resilience programs Cyber drills are the cornerstone of a robust cyber resilience program. They’re practical, hands-on simulations that allow your team to practice responding to real-world threats in a safe space before a real crisis hits. To maximize their effectiveness, cyber drills should be: Realistic: Simulate real-world attacks, including ransomware attacks, data breaches, supply chain disruptions, and social engineering attempts. Incorporate threat actors' latest tactics and techniques to prepare your team for anything. Comprehensive: Involve all relevant teams, from technical responders to senior leadership, with clear roles and responsibilities. Drills should assess technical skills, communication, coordination, and decision-making under pressure. Regular: Conducted frequently to keep skills sharp and procedures up-to-date. A continuous drilling program is ideal. Analyzed: Every drill is a learning opportunity. Conduct thorough post-incident reviews to identify areas for improvement, document lessons learned, and update incident response plans. Building a fortress: your comprehensive resilience program True resilience goes beyond drills. It's about creating a multi-layered defense. Imagine building a fortress around your organization. Cyber drills are the practice battles, but a comprehensive resilience program is the complete defense system. You start with an early warning system: your threat intelligence feeds, providing insights into the latest attack methods. Next, you educate everyone, creating a human firewall through continuous security awareness training and micro-exercises (like simulated phishing emails). You then fortify your defenses by proactively scanning for and patching vulnerabilities (vulnerability management). Finally, you develop a detailed battle plan: your incident response plan, a meticulously documented and regularly tested strategy for handling attacks. This comprehensive approach is key to long-term resilience. Resilience is practiced, refined, and ready for battle. Reducing burnout: the human element of cyber resilience Cybersecurity is a relentless, high-stakes 24/7 battle. The constant pressure to defend against evolving threats takes a toll – leading to burnout, decreased productivity, and a weaker security posture. Recognizing this human element is crucial. Building a resilient team requires proactive support. Invest in training, development, and exercising to keep skills sharp and confidence high. Promote work-life balance by encouraging breaks, vacations, and unplugging after hours. Proper rest is essential for sustained performance. Crucially, cultivate a supportive work environment. Create a space where team members feel comfortable asking for help, sharing concerns, and admitting vulnerabilities without judgment. Open communication and collaborative problem-solving are vital. Celebrate successes and acknowledge the hard work of your cybersecurity professionals. A valued, supported team is an engaged, resilient team – your best defense against evolving threats. Ready to empower your workforce and build a cyber-resilient organization? Waiting for a cyberattack to happen is a recipe for disaster. Proactive preparation is the only way to protect your organization. Building a cyber-ready workforce is an ongoing process, but it's an investment that will pay off in the long run. Share your thoughts What are your biggest challenges in building a truly cyber-ready workforce? Share your experiences and challenges in the comments below.Pieces of the Puzzle – The Power of Interconnected Cyber Drills
A crisis doesn’t respect boundaries – it unfolds in real time, demanding responses from every level, from technical teams to executives. That’s exactly what we set out to simulate with our recent cyber drill, “Pieces of the Puzzle”, a high-intensity exercise that pushed over 300 team members into the deep end of crisis response. What set this drill apart was its interconnectivity – no single person had the full picture, and every decision mattered. A crisis unfolds in pieces The exercise was built around two fictional companies: FusionArc – A cloud-based IT infrastructure provider suffering a cyberattack Orchid Logistics – A global supply chain company, FusionArc’s largest customer, facing operational chaos due to the breach. Day one simulated a cyberattack on FusionArc Solutions, with participants acting as the incident response team investigating and responding to a breach of critical systems and sensitive data. This day showcased Immersive’s cyber range capabilities and the importance of continuous upskilling. It allowed participants to practice incident response protocols and sharpen their ability to detect, analyze, and respond to cyber threats. Live technical demos showcase real-time analysis and response, bringing the simulation to life and highlighting the skills needed to combat cyberattacks. Day two shifted the perspective to Orchid Logistics, whose global operations across four major regions were thrown into turmoil due to the cascading impact of the attack. Each region had its own challenges, from disrupted healthcare supply chains in Europe to financial uncertainty in North America. Different teams’ operations, legal, communications, finance, and crisis management were forced to make critical decisions with incomplete and often conflicting information. This wasn’t just about testing individual teams. It was about stress-testing the connections between them because, in a crisis, decisions have consequences. Every action (or inaction) ripples outward, shaping how an incident unfolds and determining the effectiveness of the response. The design: controlled chaos with a purpose Running a cyber drill at this scale required intricate planning. Each element was carefully orchestrated to simulate the real-life confusion of a crisis where information is fragmented, priorities clash, and leaders must make tough choices under pressure. Key elements included: Dynamic information flow – Teams received updates in real-time, with technical teams feeding insights to crisis managers, who in turn had to make strategic decisions for the business. Regional decision-making – Each region had its own crisis management team (CMT), responsible for navigating localized challenges while staying aligned with global headquarters. Cross-functional dependencies – Operations, legal, finance, and public relations all faced their own unique crises relating to the cyberattack, as well as other unrelated business continuity disruptions. Their ability to coordinate responses mirrored the true complexity of a global business disruption. Escalating pressure – Timed injects (new crisis updates), roaming media roleplayers, and breaking news images forced participants to adapt rapidly, just as they would in a real cyber event. By layering these complexities, the exercise tested technical incident response and the entire organization’s ability to work as a single unit under duress. We looked at disaster recovery, crisis management, and business continuity all in the same cyber drill. The power of perspective (or lack of it) A key takeaway from the drill was how overwhelming it felt. No one had the full picture – teams made decisions with only their slice of the crisis, just like in the real world. We saw participants grappling with conflicting information, wondering why other teams weren’t responding as expected. Some felt completely isolated until they realized that the missing information was sitting with another team in another region, experiencing a completely different part of the crisis. This is why interconnected drills are vital. They teach organizations to connect the dots and reinforce a crucial lesson: in high-stakes environments, every decision shapes the crisis’s trajectory. Prove and improve: the true value of cyber drills Cyber drills aren’t just theoretical exercises. They test response plans, communication, and decision-making under pressure while revealing areas for improvement. This drill pushed participants to work under stress and exposed gaps not just in technical response, but in collaboration, escalation, and decision-making. These exercises matter because they don’t just reveal weaknesses – they build resilience before a real crisis strikes. What this means for your organization Cyber threats affect entire businesses – customers, partners, supply chains, and finances. The biggest risk isn’t the attack itself but poor coordination in the response. That’s why cross-team exercises are vital: technical teams must know how and when to escalate, crisis managers must grasp the stakes, and executives must make quick decisions with limited information. Cyber drills don’t always have to be this large, but they must be realistic. Even smaller exercises focused on decision-making across teams can expose gaps in communication and preparedness before a real crisis does. Final thoughts: crisis readiness is built, not assumed In the debrief of Pieces of the Puzzle, one theme emerged repeatedly: we are only as strong as our connections. The most prepared organizations aren’t just those with the best tools or plans – they’re the ones who practice together and strengthen the human elements. Cyber drills push teams to break silos, act under pressure, and manage uncertainty. If you’re not running them regularly, the question isn’t if you’ll struggle in a crisis – it’s when. No matter your industry, scale, or risk landscape, the key takeaway is this: crisis preparedness isn’t just about reacting – it’s about ensuring every piece of the puzzle fits before the crisis hits. Are your teams ready to prove and improve? Share your thoughts Has this inspired you to plan a drill? Do you have any questions about planning or execution and need some pointers? Have you run a drill or been to a drill event, and if so, how did it feel? I’d love to hear from you and help you reach your goals.
