Connect with us

Tech

CISOs in court: Balancing cyber resilience and legal accountability | Computer Weekly

Published

on

CISOs in court: Balancing cyber resilience and legal accountability | Computer Weekly


Today, the role of chief information security officer (CISO) role has transcended traditional boundaries, moving beyond managing firewalls and compliance checklists. The current landscape, marked by an upsurge in regulatory scrutiny and lawsuits against individual CISOs, demands a new approach.

To navigate this challenging environment, the CISO must become a legal sentinel, meticulously documenting decisions and establishing a verifiable defence of “due care” to protect both the enterprise and themselves from legal repercussions.

The paradox is that the more visibility CISOs have gained, the greater their legal exposure becomes. The solution lies in governance by design, a strategic approach that aligns cyber controls, risk metrics and executive communication around transparency and accountability to build trust among regulators, customers and investors. Governance by design is a proactive approach that integrates legal considerations into every aspect of cyber security strategy and decision-making, ensuring that the organisation is always prepared for legal scrutiny. In essence, cyber resilience and legal defensibility are now two sides of the same coin.

The legal landscape: Why CISOs are in the crosshairs

CISOs traditionally operated behind the scenes, focusing on threat prevention and response as technologists. Today, regulators expect CISOs to demonstrate not only technical competence but also governance maturity, ethical decision-making and transparency.  Cyber security laws, such as the SEC’s Cyber Disclosure Rules, the EU’s General Data Protection Regulation (GDPR) and state-level privacy acts like California Consumer Privacy Act (CCPA), impose explicit duties on organisations to report breaches promptly, maintain reasonable safeguards and ensure transparency in disclosures.

When organisations fail to meet these obligations, regulators and investors increasingly look to the CISO as the responsible executive. We can see this in class-action lawsuits that now routinely name CISOs as defendants, especially when plaintiffs allege that executives ignored warnings, underfunded security programmes or misled stakeholders.

The CISO’s emails, reports, and board presentations often become evidence in litigation, making documentation and communication practices critical risk factors in their own right. The CISO’s defence rests on demonstrating due diligence, proving that they provided the board with accurate risk assessments and reasonable security measures were implemented, given the company’s resources and risk profile.

Protecting the organisation: Legal foresight as a security control

To protect the enterprise, CISOs must adopt a dual-lens mindset: one focused on risk reduction through technical and operational controls, and another geared to legal defensibility. Several best practices help balance these priorities, ensuring that legal implications are considered in every security decision.

  • Embed legal awareness in cyber strategy: By integrating legal counsel into incident response, risk assessment, tabletop exercises, data protection impact assessments and vendor management discussions, security leaders can ensure that regulatory implications are understood before crises occur.
  • Build a defensible documentation trail: CISOs must document major security decisions, such as risk acceptance, budget trade-offs and vendor selections, along with the rationale, as these records become invaluable in proving due diligence if an incident leads to regulatory review or litigation.
  • Adopt a “disclosure-ready” posture: Ensuring that systems are in place for early breach detection, internal escalation and timely communication to leadership is crucial. This transparency, when clearly implemented, can mitigate reputational and legal fallout.
  • Implement continuous oversight and board reporting: Presenting regular security briefings to the board that focus on measurable risk indicators, rather than just providing technical updates, helps drive accountability and distribute liability more equitably across governance layers.

Protecting the CISO: Personal legal safety nets

As accountability grows, CISOs must treat their personal risk exposure as part of professional hygiene. The following safeguards are now essential components of an executive’s toolkit:

  • Directors and officers (D&O) insurance cover: CISOs must ensure that their comprehensive D&O insurance explicitly includes cyber security-related claims and personal indemnification clauses that specifically address the CISO role. 
  • Document and escalate material risks: If CISOs identify systemic weaknesses, such as a lack of funding, unpatched legacy systems, or noncompliance, they must formally escalate these risks to leadership and record the communication, as silence or informal discussions can later be construed as negligence.
  • Establish a personal legal relationship: In high-stakes scenarios, the company’s counsel represents the organisation, not the individual. CISOs should have access to independent legal advice when handling investigations or disclosure decisions involving personal accountability.
  • Maintain ethical and transparent communication: Misrepresentation is often the catalyst for prosecution. When briefing executives or regulators, the CISO must ensure that all statements are factual and appropriately qualified. Overpromising on security posture or mischaracterising an incident can backfire.
  • Foster a culture of shared responsibility: The CISO should advocate that cyber security is a collective enterprise responsibility, not a siloed function. Embedding security accountability across engineering, operations and business units helps dilute individual liability and strengthen overall resilience.

Summing up

The CISO operates in one of the most demanding roles in the modern economy. Their technical expertise is what builds the defensive wall, but their diligence in governance and documentation is what creates the legal fort. By integrating legal foresight into cyber strategy, documenting transparent governance and securing personal protection, CISOs can transform potential liability into institutional resilience. CISOs must consistently demonstrate a defensible standard of reasonable security and absolute transparency to lead their organisation through an age defined by digital risk and legal scrutiny. Cyber security leadership is no longer just about protecting systems, it’s about protecting the people who defend the organisation including the CISO and their team.

Aditya K Sood is vice president of security engineering and AI strategy at Aryaka.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Just in Time for Spring, Don’t Miss These Electric Scooter Deals

Published

on

Just in Time for Spring, Don’t Miss These Electric Scooter Deals


The snow is melting, the days are getting longer, and I can almost smell the springtime ahead. Soon, we’ll be cruising around town on ebikes and electric scooters instead of burning fossil fuels. For now, the weather hasn’t quite caught up, which is great for markdowns. Many of the best electric scooters are still seeing significant discounts. If you’ve been thinking about buying one, now’s the best time: prices are low, and sunny commuting days are just ahead.

Gear editor Julian Chokkattu has spent five years testing more than 45 electric scooters. These are his top picks that are also on sale right now.

Apollo Go for $849 ($450 Off)

Photograph: Julian Chokkattu

This is Gear editor Julian Chokkattu’s favorite scooter. The riding experience is powerful and smooth, thanks to its dual 350-watt motors and solid front and rear suspensions. The speed maxes out at 28 miles per hour (mph), which doesn’t make it the fastest scooter on the market, but it has a good range. (Chokkattu is a very tall man and was able to travel 15 miles on a single charge at 15 mph.) Other Apollo features he appreciates: turn signals, a dot display, a bell, along with a headlight and an LED strip for extra visibility.

Apollo Phantom 2.0 for $2099 ($900 Off)

  • Photograph: Julian Chokkattu

  • Photograph: Julian Chokkattu

  • Photograph: Julian Chokkattu

The Apollo Phantom 2.0 maxes out at 44 mph, with plenty of power from its dual 1,750-watt motors. It’s a gorgeous scooter, designed with 11-inch self-healing tubeless tires and a dual-spring suspension system for a smooth riding experience. But with great power comes great weight. At 102 pounds, the Phantom 2.0 is the heaviest electric scooter Chokkattu has tested, so I would only recommend this purchase if you don’t live in a walkup and/or have a garage.

More Discounted Electric Scooters

Segway

Max G3

This is the best commuter scooter, with more power and range than the Apollo Go and a fast 3.5-hour recharge time.

Segway

Ninebot F3 Electric Scooter

The Segway F3 is designed with turn signals, a bell, a bright display, and a feature-rich app experience.

Niu KQi 300X

This is the best all-terrain scooter, with reliable suspension, dual disc brakes, and thick 10.5-inch tubeless tires.

Segway

E2 Pro

This is the best budget scooter, designed with a decent 350-watt motor, a max speed of 15 mph, a front drum brake, and a rear electronic brake.



Source link

Continue Reading

Tech

What’s an E-Bike? California Wants You to Know

Published

on

What’s an E-Bike? California Wants You to Know


A few months ago, a family came into Pasadena Cyclery in Pasadena, California, for a repair on what they thought was their teenager’s e-bike. “I can’t fix that here,’ Daniel Purnell, a store manager and technician, remembers telling them. “That’s a motorcycle.” The mother got upset. She didn’t realize that what she thought was an e-bike could go much faster, perhaps up to 55 miles per hour.

“There’s definitely an education problem,” Purnell says. In California, bike advocates are pushing a new bill designed to clear up that confusion around what counts as an electric bicycle—and what doesn’t.

It’s a tricky balance. On one hand, backers want to allow riders access to new, faster, and more affordable non-car transportation options, ones that don’t require licenses and are emission-free. On the other hand, people, and especially kids, seem to be getting hurt. E-bike-related injuries jumped more than 1,020 percent nationwide between 2020 and 2024, according to hospital data, though it’s not clear if the stats-keepers can routinely distinguish between e-bikes and their faster, “e-moto” cousins. (Moped and powered-assisted cycle injuries jumped 67 percent in that same period.)

“We’re overdue to have better e-bike regulation,” says California state senator Catherine Blakespear, a Democrat who sponsored the bill and represents parts of North County in San Diego. “This has been an ongoing and growing issue for years.”

Senate Bill 1167 would make it illegal for retailers to label higher-powered, electric-powered vehicles as e-bikes. It would clarify that e-bikes have fully operative pedals and electric motors that don’t exceed 750 watts, enough to hit top speeds between 20 and 28 mph.

“We’re not against these devices,” says Kendra Ramsey, the executive director of the California Bicycle Coalition, which represents riders and is promoting the legislation. “People think they’re e-bikes and they’re not really e-bikes.”

Bill backers say they hope the fix, if it passes, makes a difference, especially for teenagers, who love the freedom that electric motors give them but can get into trouble if something goes wrong at higher speeds. Kids 17 and younger accounted for 20 percent of US e-bike injuries from 2020 to 2024, about in line with the share of the total population. But headlines—and the laws that follow them—have focused on teen injuries and even deaths.

There are no national laws governing e-bike riding. But bike backers spent years moving between states to pass laws that put e-bikes into three classes: Class 1, which have pedal-assist that only works when they’re actually pedaled, and goes up to 20 mph; Class 2, which have throttles that work without pedaling but still only reach 20 mph; and Class 3, which use pedal-assist to move up to 28 mph. Plenty of states and cities restrict the most powerful Class 3 bikes to people older than 16. (In a complicated twist, some e-bikes have different “modes,” allowing riders to toggle between Class 2 and Class 3.)

Last year, researchers visited 19 San Francisco Bay Area middle and high schools and found that 88 percent of the electric two-wheeled devices parked there were so high-powered and high-speed that they didn’t comply with the three-class system at all.

E-bikes have clearly struck a chord with state policymakers: At least 10 bills introduced this year deal with e-bikes, according to Ramsey.

Some bike advocates believe injuries have less to do with e-bikes than “e-motos,” a category that’s less likely to appear in retail stores or the sort of social media ads attracting teens to the tech. These have more powerful motors and can travel in excess of 30 mph. Vehicles, like the Surron Ultra Bee, which can hit top speeds of 55 mph, or Tuttio ICT, which can hit 50, are often marketed by retailers as “electric bikes.” Because so many sales happen online, it can be hard for people, and especially parents, to know what they’re getting into.



Source link

Continue Reading

Tech

OpenAI Fires an Employee for Prediction Market Insider Trading

Published

on

OpenAI Fires an Employee for Prediction Market Insider Trading


OpenAI has fired an employee following an investigation into their activity on prediction market platforms including Polymarket, WIRED has learned.

OpenAI CEO of Applications, Fidji Simo, disclosed the termination in an internal message to employees earlier this year. The employee, she said, “used confidential OpenAI information in connection with external prediction markets (e.g. Polymarket).”

“Our policies prohibit employees from using confidential OpenAI information for personal gain, including in prediction markets,” says spokesperson Kayla Wood. OpenAI has not revealed the name of the employee or the specifics of their trades.

Evidence suggests that this was not an isolated event. Polymarket runs on the Polygon blockchain network, so its trading ledger is pseudonymous but traceable. According to an analysis by the financial data platform Unusual Whales, there have been clusters of activities, which the service flagged as suspicious, around OpenAI-themed events since March 2023.

Unusual Whales flagged 77 positions in 60 wallet addresses as suspected insider trades, looking at the age of the account, trading history, and significance of investment, among other factors. Suspicious trades hinged on the release dates of products like Sora, GPT-5, and the ChatGPT Browser, as well as CEO Sam Altman’s employment status. In November 2023, two days after Altman was dramatically ousted from the company, a new wallet placed a significant bet that he would return, netting over $16,000 in profits. The account never placed another bet.

The behavior fits into patterns typical of insider trades. “The tell is the clustering. In the 40 hours before OpenAI launched its browser, 13 brand-new wallets with zero trading history appeared on the site for the first time to collectively bet $309,486 on the right outcome,” says Unusual Whales CEO Matt Saincome. “When you see that many fresh wallets making the same bet at the same time, it raises a real question about whether the secret is getting out.”

Prediction markets have exploded in popularity in recent years. These platforms allow customers to buy “event contracts” on the outcomes of future events ranging from the winner of the Super Bowl to the daily price of Bitcoin to whether the United States will go to war with Iran. There are a wide array of markets tied to events in the technology sector; you can trade on what Nvidia’s quarterly earnings will be, or when Tesla will launch a new car, or which AI companies will IPO in 2026.

As the platforms have grown, so have concerns that they allow traders to profit from insider knowledge. “This prediction market world makes the Wild West look tame in comparison,” says Jeff Edelstein, a senior analyst at the betting news site InGame. “If there’s a market that exists where the answer is known, somebody’s going to trade on it.”

Earlier this week, Kalshi announced that it had reported several suspicious insider trading cases to the Commodity Futures Trading Commission, the government agency overseeing these markets. In one instance, an employee of the popular YouTuber Mr. Beast was suspended for two years and fined $20,000 for making trades related to the streamer’s activities; in another, the far-right political candidate Kyle Langford was banned from the platform for making a trade on his own campaign. The company also announced a number of initiatives to prevent insider trading and market manipulation.

While Kalshi has heavily promoted its crackdown on insider trading, Polymarket has stayed silent on the matter. The company did not return requests for comments.

In the past, major trades on technology-themed markets have sparked speculation that there are Big Tech employees profiting by using their insider knowledge to gain an edge. One notorious example is the so-called “Google whale,” a pseudonymous account on Polymarket that made over $1 million trading on Google-related events, including a market on who the most-searched person of the year would be in 2025. (It was the singer D4vd, who is best known for his connection to an ongoing murder investigation after a young fan’s remains were found in a vehicle registered to him.)



Source link

Continue Reading

Trending