|
Bayou Bytes // Issue #15 · The Acting CISO
Come, Take Your First Byte.
Three sections. Starting now.
|
|
The field guide: Gatorbyte #016
Gatorbyte #016 — free, runs offline as a Windows app
The Leaked-Secret Response Kit →
Free to use inside your organization and with your clients, including in paid engagements. A practical starting point to review and adapt for your organization; not legal, compliance, or audit advice, and not a substitute for a forensic investigation or your incident-response plan.
|
|
The Pulse
|
|
Every Tuesday: the threats worth your attention, one habit you can start this week, and the plain-English version your non-technical client needs to hear. Three things this week — and, our read, all three are things an acting CISO is expected to know about without being told: forgotten legacy services, a VPN whose exposure depends on a setting, and the tool that manages client environments.
Now, this week:
|
|
Old bugs, a setting-dependent exposure, and the management tool itself.
1 · Five older flaws, added to the catalog. Per The Hacker News, CISA added five older vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Oct 8: ProFTPD CVE-2015-3306, ONLYOFFICE Docs CVE-2021-3199, Strapi CVE-2023-22894, Apache Struts CVE-2016-3081 and ISC BIND CVE-2015-5477. The federal due date was Oct 11 — and it binds federal civilian executive branch agencies only; for everyone else it is a signal, not a deadline. Our read: services this old are exactly what an inventory exists to find.
→ thehackernews.com · five flaws added to KEV
2 · A VPN flaw whose exposure depends on a setting. Palo Alto Networks PAN-OS GlobalProtect / Prisma Access CVE-2026-0257 is an authentication bypass. Per cybersecuritynews.com, ransomware groups are reported to be exploiting it to create unauthorized VPN sessions; the activity was reported by ReliaQuest. Exposure depends on configuration: authentication override cookies enabled plus a specific certificate configuration. Per the article, the mitigation is to upgrade per the vendor’s fixed-version table, disable unnecessary override cookies, and use a newly generated certificate dedicated to them. The article does not say whether this is in KEV; CISA’s catalog does: added May 29, federal due date Jun 1 (federal civilian agencies only; we checked the catalog Oct 13).
→ cybersecuritynews.com · GlobalProtect VPN access
3 · An August callback: the MSP’s own management tool. N-able N-central CVE-2026-18577 is an authentication bypass. Per The Hacker News, CISA added it to KEV on Aug 3, with a federal due date of Aug 6 (federal civilian agencies only). N-able acknowledged that “a limited number of customers” were compromised; the fix is in version 2026.3 HF1. Our read: it belongs on the inventory with its version written next to it.
→ thehackernews.com · N-central added to KEV (Aug)
Our read: all three are things an acting CISO is expected to know without being told. An inventory with versions and configuration notes turns “are we exposed?” into a lookup. We are not saying any client of anyone was compromised in these campaigns beyond what the sources report, and we do not know which of these products you run.
|
|
|
The Hardened Stack
Deep Dive: the acting-CISO weekly cadence.
|
|
Our read: when a client says “you handle our security,” they are asking you to do a CISO’s job whether or not anyone wrote that down.
The number. A survey commissioned by Sophos, a security vendor — so read the method, not just the headline — asked 800 MSPs across the US, UK, Germany, France, Singapore, Australia and Brazil. Vanson Bourne ran it in April 2026 for Sophos, and Sophos published the results on Sep 15. In the Sophos-commissioned survey, on average, MSPs estimate that 46% of their customers rely on them to act as CISO. That is the MSPs’ own estimate, not a count of customers, and the survey measures MSP perception and practice, not security outcomes. In the same Sophos-commissioned survey, 84% of MSPs expect demand for CISO services to rise over the next 12 months — an expectation, not a measurement.
The gap. Per the Sophos-commissioned survey, 99% of MSPs provide at least one cybersecurity compliance service, yet only 33% say they are completely confident they can monitor, manage and document compliance continuously across customers. On reporting, in the Sophos-commissioned survey, 55% still need some manual effort to build consolidated posture reports, and only 31% can generate them quickly through a fully automated process. Sophos’s Scott Barlow put it this way: “The challenge now is delivering that leadership consistently and efficiently across a growing customer base.”
Our read: the gap looks like a missing cadence more than a missing tool. A cadence is a practical starting point to adapt — the same few questions, answered the same way, on a schedule, with the evidence kept. That is what makes the role repeatable and easier to show. Here is our starting point:
|
ACTING-CISO WEEKLY CADENCE
Our starting point - adapt it.
Same day, same order, every client.
[ ] 1 INVENTORY
Systems, accounts,
internet-facing services.
An owner on every line.
[ ] 2 EXPOSURE CHECK
What faces the internet,
which version, which
settings matter.
(Versions alone miss it.)
[ ] 3 KNOWN-EXPLOITED CHECK
Compare the inventory to
CISA KEV on a fixed day
each week. Due dates bind
federal civilian agencies
only - a signal, not your
deadline.
[ ] 4 RISK REGISTER
Top items, owner, decision
(fix / accept / transfer),
date.
[ ] 5 EVIDENCE
Keep what you checked and
when: screenshots, exports,
ticket links.
[ ] 6 ONE-PAGE REPORT
Same shape every time: what
changed, what you decided,
what is open, what you need
from the client.
|
|
|
Notice what steps 1 and 2 did for the Pulse above: an inventory that records versions and settings can turn “are we exposed?” into a lookup (our read), helps you find the forgotten ProFTPD box, and puts your own management tool on the list. Steps 5 and 6 are the ones that help make the work show-able — our read: if you cannot show what you checked and when, it is hard for a client to know it happened.
|
|
This cadence is our own framing, not a standard and not drawn from the survey. It is a practical starting point to review and adapt for your organization; not legal, compliance, or audit advice. We do not give advice on liability, insurance, or whether a title like “vCISO” carries any regulatory meaning — for any specific contract, that is a question for counsel.
|
|
|
The Boardroom Bridge
Writing down what you are — and are not — accountable for
|
|
The talking point (a literal script for an MSP or vCISO to say to a client — steal it)
|
|
“You have told us more than once that we handle your security. I want us to write down what that means, on one page, so neither of us is guessing. Left side: what we do — what we check, how often, what we report to you. Right side: what stays with you — decisions to accept a risk, budget, who gets access, which vendors you use. And a third box for anything we have not agreed on yet, marked as unclear instead of assumed. A survey commissioned by Sophos, a security vendor, found that MSPs estimate, on average, that 46% of their customers rely on them to act as CISO — that is their estimate, not a count. I would rather we be in that number on purpose than by accident. I am not giving legal advice, and this page is not a contract. Have your counsel review any contract language before we change it.”
|
|
|
Our read: clients rarely object to clarity; they object to surprises. A one-page “we do / you decide / still open” sheet, reviewed on the same cadence as everything else, is a shared reference. Whether the work is currently contracted, scoped or insured is the open question — and it is yours to settle with counsel, not ours.
|
|
|
|
This week’s tool — AxiomLens
|
|
AxiomLens supports the weekly rhythm: 106 subcategories, computed coverage, evidence tied to controls, board reports written on your machine. One-time, per named user, and nothing phones home after activation. It supports compliance documentation and audit-prep workflows; a tool, not a certification, and not legal, compliance, or audit advice.
One-time license — see the store page for details.
|
|
|
|
Sources:
Sophos press release via GlobeNewswire — MSPs Have Quietly Become Acting CISO for Nearly Half of Their Customers (Sep 15, 2026) |
The Hacker News — five flaws added to KEV |
cybersecuritynews.com — GlobalProtect |
The Hacker News — N-central (Aug 2026) |
CISA Known Exploited Vulnerabilities catalog (check directly)
The survey was commissioned by Sophos, which sells security products; Vanson Bourne conducted it (800 MSPs, April 2026). Sophos figures are MSP-reported perception and practice, not security outcomes. KEV remediation dates bind federal civilian agencies only. The Security Gator is not affiliated with Sophos, Vanson Bourne, Palo Alto Networks, N-able, or any vendor named above.
|
|
THE SECURITY GATOR // BAYOU BYTES // EVERY TUESDAY
|
|
|
