Insights · Cybersecurity · Insight · 30 September 2026

After three exploited flaws, a CISO's shortlist runs through peers

A CISO weighs a security vendor through practitioners who have patched the problem. This week CISA added an exploited Zyxel switch flaw to its KEV catalog [3], Arista patched an exploited VeloCloud zero-day [5], and a malicious npm package posed as a security probe [1]. After each, a security team asks peers before it calls a vendor.

Which exploited flaws reached security teams this week

Security engineers had three exploited products to deal with this week. On Monday CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches with a CVSS score of 8.8, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation [3]. The same report covers a Veeam flaw under exploitation, with the two flaws giving attackers command execution and SYSTEM access [3]. Arista released patches for a zero-day in VeloCloud Orchestrator On-Prem that attackers were already using [5].

None of these reached a SOC lead as a vendor pitch. A KEV entry arrives as an obligation with a deadline, and the first question on the call is practical: who has patched it, and what broke when they did. People answer that. A security engineer who writes up a Zyxel patch window, with the switch models and the downtime, finds readers in the teams running the same hardware that week, and earns a place in the committee's reading list before any vendor gets a meeting.

Why a fake security tool changes whose advice CISOs trust

Researchers disclosed a malicious npm package, tw-pkgprobe-7731, that posed as a security tool for developers integrating Twilio while it tried to harvest sensitive data [1]. An account called twdepprobe7731 uploaded it to the registry in mid-August 2026, about five weeks before researchers named it [1].

The package borrowed the look of a bug-bounty probe, the kind of utility a security engineer installs on a colleague's recommendation. Once a fake tool can pass as a real one, the name behind the recommendation carries the weight. A Head of Security Engineering can check who published a package. The harder check is whether anyone they trust has run it and written about the result.

For a vendor, a practitioner's public account of using the product becomes the first evidence a technical evaluator looks for, ahead of anything on the product page. Buyers weigh that account above the vendor's own claims because the practitioner has nothing to sell them.

How CISA's deception guide reaches teams with small budgets

CISA published guidance to help organizations with limited resources set traps for attackers, taking an older technique back to basics [4]. The audience is the security team with two analysts and no deception budget.

A government guide tells that team what to do. The practical detail comes later, on the afternoon someone deploys the first decoy and learns which alerts it floods. Practitioners supply that detail: a GRC lead who publishes how they mapped the guide to their controls, or a SOC analyst who shares the decoy that caught a real intruder. Small teams copy those write-ups line by line.

A small team deciding whether to build from the guide or buy a product leans on the practitioner who documented the build. A vendor who sponsors that practitioner's next write-up joins a conversation the team already trusts, on the team's terms, and meets the buyer at the point where build-or-buy gets settled.

Why the CISO and CMO now answer the same board question

Dark Reading argues that security and brand reputation are linked, and that organizations with regular CISO-CMO touchpoints and joint crisis communications plans will outperform those treating security as an IT concern [2]. The piece describes an alliance built before a crisis, when the two functions agree on how a breach will be explained.

That changes who sits in a security purchase. If the CMO co-owns the breach story, the CMO forms a view of the vendor too, and that view comes from the same public conversation the CISO reads. A practitioner who can explain an exploited switch flaw in terms of customer trust speaks to both chairs in one post.

Vendors who write only for the SOC miss half of that committee. The creators worth backing in this category can hold a technical audience and still make sense to a marketing leader reading over the CISO's shoulder.

Where practitioner trust shows up in security pipeline

Measurement in this category runs into a limit you should name up front. Security buyers share links in private channels, and attribution fires on a click, so a forwarded post that reached a CISO leaves no trace. You can still count a narrower thing. A tracked link on a practitioner's post records the visit. On your own site, account identification resolves the company behind that visit when the lookup succeeds. Match those companies against your target list and follow them into the CRM, and you can report which practitioner's post came before which opportunity. That report is a floor. It misses the Signal thread and the hallway conversation, and it credits one touch where a real deal had several. Present it to your CFO as the minimum a creator contributed.