White papers
Leveraging Generative Artificial Intelligence for Tabletop Exercise Development
The Cost of Cyber Defense: CIS Controls IG1
Looking to implement cyber defenses? You probably want to know three things:
- Which protections will you start with?
- Which tools will be needed to implement those protections?
- How much will an implementation cost?
The Cost of Cyber Defense: CIS Controls IG1
Looking to implement cyber defenses? You probably want to know three things:
- Which protections will you start with?
- Which tools will be needed to implement those protections?
- How much will an implementation cost?
Guide to Asset Classes: CIS Critical Security Controls v8.1
CIS Controls v8.1 Mapping to NIS2 Directive 2022:2555
This document contains mappings of CIS Critical Security Controls® (CIS Controls®) v8.1 and CIS Safeguards to Network and Information Security 2 (NIS2) Directive 2022:2555.
The Evolving Role of Generative Artificial Intelligence in the Cyber Threat Landscape
The adoption of Generative Artificial Intelligence (GenAI) for malicious cyber activity is in a transitional period. Cyber threat actors (CTAs) are exploring incorporating GenAI into their campaigns while relying on more traditional tactics, techniques, and procedures (TTPs). The use of these platforms is growing, but widespread adoption is limited by technical barriers, defenses, and the proven effectiveness and reliability of more conventional attack methods. Network defenders are learning to leverage GenAI to improve detections, defeat existing attacks, and mitigate the spread of GenAI-enhanced attacks. The result is a race between network defenders and CTAs seeking to gain the upper hand in deploying GenAI.
CIS Controls v8.1 Mapping to NIST SP 800-171 Rev 3
This document contains mappings of CIS Critical Security Controls® (CIS Controls®) v8.1 and CIS Safeguards to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.
CIS API Security Guide v1.0.0
Active Directory and Group Policy Management Best Practices
Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
In a world faced with varying degrees of cyber-attacks, implementing a cybersecurity framework can be a logical, but daunting, task. An enterprise needs a way to prioritize the implementation of security controls. For those using or wanting to use the CIS Critical Security Controls (CIS Controls) in their cybersecurity journeys, the Center for Internet Security® (CIS®) has developed Implementation Groups (IGs) — divided into IG1, IG2, and IG3 — to help prioritize the implementation of the CIS Controls. IGs are based on several factors — size and/or complexity, data types, resources and technology, threat types, and risk. Each IG identifies a set of CIS Safeguards that the enterprise should implement.
Cloud Companion Guide for CIS Controls v8.1
The Rise of Agentic AI: Autonomous Decision-Making and Its Implications:
Executive summary
Agentic AI—systems that can plan, act, and learn with minimal human prompting—are moving from demos to enterprise deployment. Unlike single-shot chatbots, these systems orchestrate large language models (LLMs), specialized tools, and organizational data to run end-to-end workflows. Early adopters are applying them to enterprise operations, healthcare coordination, supply chains, and customer experience.
Quantum Computing: Transforming IT Infrastructure & Threatening Cybersecurity
Executive summary
Quantum computing is moving from laboratory prototypes into early enterprise pilots. While practical use cases remain narrow—such as optimization, materials discovery, and risk modeling—the cybersecurity threat is broad and strategic. Attackers are already harvesting encrypted data today (“harvest now, decrypt later”) in anticipation of future quantum breakthroughs.
Zero Trust Architectures in a Hybrid Work Era
Executive summary
Perimeter-based security is no longer viable in a world of hybrid and remote work, SaaS adoption, and cloud-native applications. Zero Trust Architecture (ZTA) enforces continuous verification, least-privilege access, and micro-segmentation across users, devices, applications, and data.
AI-Powered Cyber Attacks & Defenses: The Double-Edged Sword
Executive summary
Artificial intelligence is reshaping the cyber battlefield. Attackers are using AI to automate reconnaissance, generate hyper-personalized phishing lures, and craft polymorphic malware. At the same time, defenders are deploying AI to accelerate detection, triage, and incident response.
Cloud Migration & AI-Driven Digital Transformation in the Enterprise
Executive summary
Cloud adoption has become table stakes—but the real multiplier comes when enterprises design for AI as a first-class workload. Modern data platforms, GPU strategy, and AI governance need to be embedded from the start, not bolted on later.
Responsible AI in Regulated Industries
Executive Summary
In regulated industries—finance, healthcare, insurance, energy—AI is both a growth engine and a compliance liability. Leaders must balance innovation with strict regulatory mandates. Failures are not just reputational—they can trigger fines, license loss, or litigation.
Decentralized Identity & Zero Trust Security Models
Executive Summary
Traditional identity systems—passwords, centralized directories, perimeter security—are collapsing under the weight of cyber threats, remote work, and regulatory mandates. Enterprises are shifting toward:
AI-Augmented DevOps: Automating Software Delivery Pipelines
Summary
Software delivery cycles are accelerating beyond human capacity. Enterprises must deliver features continuously, patch vulnerabilities instantly, and ensure uptime at scale. Traditional DevOps has automated parts of CI/CD, but bottlenecks remain: manual testing, incident triage, root-cause analysis, and environment optimization.
5G & Edge Computing: Enterprise Opportunities and Security Risks
Executive Summary
The convergence of 5G networks and edge computing is reshaping enterprise IT. Together, they enable ultra-low-latency applications, real-time analytics, and distributed intelligence closer to end users. This unlocks opportunities in autonomous vehicles, remote healthcare, smart factories, and immersive AR/VR experiences.
Digital Twins & Enterprise Simulation Platforms: Strategy, Value, and Risk
Executive Summary
Digital twins—virtual representations of physical systems, assets, or processes—are becoming central to enterprise innovation. When combined with IoT, AI/ML, and simulation platforms, they enable predictive insights, real-time monitoring, and lifecycle optimization across industries.
FinOps 2.0: Cost Governance for AI/ML & GPU-Intensive Workloads
Summary
AI/ML workloads—especially those involving GPUs—are among the fastest-growing drivers of cloud spend. Training, fine-tuning, and high-throughput inference create highly variable demand patterns and complex cost structures. FinOps 2.0 provides a practical framework for governing these costs, balancing innovation with financial accountability.