A coalition of 35 major business and industry associations has urged Congress to extend the Cybersecurity Information Sharing Act of 2015 (CISA 2015) for another 10 years through the fiscal year 2027 National Defense Authorization Act (NDAA).
The November 1 letter, organized by Business Roundtable, was signed by organizations representing banking, healthcare, energy, telecommunications, manufacturing and other critical infrastructure sectors.
CISA 2015 provides legal protections that encourage companies to voluntarily share cyber threat intelligence with one another and the federal government. The law’s current temporary extension expires December 11.
The coalition warned that AI-enabled cyberattacks are accelerating vulnerability discovery and exploitation, making rapid threat intelligence sharing increasingly important.ㅤ
Industry groups argue that allowing the law to lapse could discourage companies from sharing critical cybersecurity information.
ㅤDarin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security
“I’ve often seen organizations where fraud teams are investigating losses measured in the millions, while other teams within the same company understand threats such as subdomain takeovers, digital impersonation, and synthetic identity abuse. Both groups have valuable knowledge, but they speak different languages. One sees financial losses and suspicious transactions; the other sees technical indicators, infrastructure, and attack paths. Sometimes the intelligence needed to understand a larger problem is already inside the organization. We simply haven’t connected it.
“That brings me to artificial intelligence and the wisdom of crowds. Independent perspectives can produce better judgments than isolated observations, particularly when those perspectives contribute different expertise. AI gives us an opportunity to translate between disciplines, correlate observations, and recognize patterns at a scale we could never manage manually.
“But collective intelligence is not automatically collective wisdom. Ten systems repeating the same incorrect assumption do not constitute ten independent confirmations. We need diversity of information, evidence, context, and independent verification.
“Now imagine extending that cooperation across financial institutions, healthcare organizations, critical infrastructure, and government. The discussion surrounding CISA 2015 is about more than legal protections. It raises a larger question about how we share intelligence responsibly and turn fragmented observations into actionable defense.
“NIST SP 800-150 provides useful guidance for building those relationships. Technical mechanisms such as STIX, TAXII, MISP, and TLP help address different aspects of information exchange, but standards alone cannot resolve differences in understanding. AI may help us connect the dots. Good governance, privacy safeguards, and independent validation help ensure we’re connecting the right ones.
“And that is where bringing together different domains of expertise can uncover hidden knowledge, revealing connections and patterns that no single discipline could recognize on its own.
“The greatest intelligence failure may not be what we don’t know, but what we collectively known and fail to understand together.”
ㅤ
John Strand, Owner, Black Hills Information Security
“The only way we survive in computer security is by sharing information. This program gives us a way to do exactly that. I’m absolutely ecstatic that it’s being renewed and moving forward. Information sharing is key.”
ㅤWhile it would be very nice to have the CISA renewed, organizations need to chart their own course. Because you cannot depend on a third party to defend you.
Google’s Botnet Takedown Reveals a Bigger Threat to Business APIs
Posted in Commentary with tags Google on November 4, 2026 by itnerdGoogle’s takedown of the XCPE botnet, which reportedly infected more than 1.3 million Android devices, highlights a growing concern beyond compromised consumer devices: how cybercriminals are turning those devices into infrastructure for attacks on businesses.
Google has a blog post here: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet
Mark Mazur, Field CTO, Approov:
“This takedown really highlights the dangerous incentives of monetization behind malware and backdoor exploits. By turning 1.3 million devices into residential proxies, threat actors fuel the exact infrastructure used to attack high-value API endpoints. Because these attacks originate from legitimate consumer IP addresses, standard geo-blocking, ASN blocking and IP reputation filters are practically useless against them.
They are creating infrastructure, largely based on IoT devices, that can power sophisticated credential stuffing and API abuse campaigns.”
Takedowns are nice. But there needs to be sustained action to make sure that these stick. Otherwise they are meaningless.
Leave a comment »