A cascading supply chain attack did not start with a zero-day exploit, an unpatched vulnerability, or a brute-force attack. It started with a bored employee wanting to get ahead in an online game. A Context.ai employee downloaded a Roblox game cheat, an unofficial script for an online game that came bundled with Lumma Stealer malware […]

As we move further into 2026, the security landscape continues to evolve in parallel with ongoing global uncertainty. Our latest report, “Top Recommendations For Your Security Program, 2026,” provides timely guidance for security leaders as they navigate another precarious year for their roles, programs, and organizations. Join us in this webinar to go over highlights from our 2026 recommendations and hear directly from the analysts making these calls.Key takeaways: Learn the most important recommendations for your security strategy in 2026 and our rationale behind them.Leverage our research and insights to guide your security program strategy.Understand how to prioritize changes in areas including AI and data governance, security budgets and staffing, post-quantum security, and critical infrastructure in the coming year.Target audience level: intermediate

RSAC Conference 2026 has come and gone. Gone, too, are the petting zoos of yesteryear, replaced this year by — of all things — pop-up tattoo parlors. Or as one attendee observed, “We’ve traded livestock for live needles.” This year’s attendance of over 43,500 was flat compared to 2025, but the sessions and exhibit floor […]

Our annual top security recommendations guide security leaders and their programs through 2026, a year of continued volatility, with advice on dealing with budget pressures, talent gaps, continued vendor consolidation and data sovereignty demands, and an intensifying threat landscape driven by geopolitical turmoil. We also provide recommendations for tackling challenges that are increasing in urgency, like AI governance and post-quantum security, to help leaders set a course before widespread adoption forces a scramble to respond.

You can use microsegmentation solutions to implement more granular access control without rearchitecting the network, prevent and contain ransomware and other attacks, and satisfy compliance obligations. But to realize these benefits, you’ll first have to select from a diverse set of vendors that vary by size, type of offering, geography, and use case differentiation. Security and risk professionals should use this report to understand the value they can expect from a microsegmentation solutions vendor, learn how vendors differ, and investigate options based on size and market focus.

The annual RSAC Conference in San Francisco is the cybersecurity industry’s biggest event of the year. For the analysts attending, RSAC Conference week provides an opportunity to learn about cybersecurity trends and topics, meet with vendors and clients, and share our insights and observations. It’s also an excellent opportunity to meet our daily step goals […]

CrowdStrike’s move to acquire Seraphic spotlights a growing blind spot in cybersecurity: The browser has quietly become one of the riskiest — and least protected — endpoints in the enterprise. This blog reveals why legacy EDR, XDR, and network tools can’t see what’s really happening inside the browser and how Seraphic’s unique JSE‑based approach could change the game for data protection and threat detection.

Former Forrester analyst Josh Zelonis blogged about how to deliver successful vendor briefings years ago. I’m updating his blog with my own thoughts as a “recovering marketer,” Forrester analyst, and research director. This blog is a collection of my top tips for briefing analysts, with contributions from other security and risk analysts.

Every point at which packets begin, traverse, and end has the potential to become a gateway that adversaries can exploit and win command and control of critical network assets. Network security pros must protect these pathways to enhance security and promote a robust Zero Trust architecture. To advance Zero Trust, modern methods, including identity-driven segmentation, ZT network access (ZTNA), and microsegmentation, help create granular microperimeters that protect against modern, evolving threats. This report delves into the essential network tools, packet-level controls, and other security technologies that security and risk professionals should employ as their organization moves to embrace a Zero Trust strategy.

Zero Trust (ZT) is the de facto security model for many business and government organizations, but security leaders often don’t know where to begin architecting and implementing it; they can be daunted by the fundamental shifts in strategy and architecture that ZT demands. Contrary to popular belief, a Zero Trust architecture does not require ripping out current security controls and starting anew. With the right approach, security leaders can increase their ZT competence and realize security benefits right away. This report guides security leaders through a roadmap for implementing ZT using practical building blocks that take advantage of existing technology investments and current maturity.