Research

Protecting The Crown Jewels: How to Secure Your Mission-Critical Information Assets

Your organisation depends on vital systems, data, and people - but are your mission-critical assets truly protected? Our framework delivers six actionable recommendations to strengthen resilience and secure what matters most.

research

Cyber Awareness:
Kickstart your security culture

Trusted insights in an easy-to-share format designed to accelerate CISOs and their team's ability to build a resilient security culture.

Download now

research

AI Insights: AI security governance

AI Security Governance Seizing Opportunities and Controlling Risks Artificial Intelligence is rapidly becoming a core…

research

AI Insights: AI ethics and transparency

AI Ethics and Transparency Navigating organisational risks and responsibilities As AI becomes deeply embedded in…

research

AI Insights: Agentic AI

Agentic AI Autonomy is its greatest strength and its biggest weakness As agentic AI systems…

research

ISF: Your first line of defence in safeguarding your organisation

A resource centre with digital and downloadable resources dedicated to supporting your organisation in its journey to become resilient by design.

research

ISF: Your first line of defence in supplier security risk management

A lot of organisations have outsourced to a third party and so they feel as…

research

ISF: Your first line of defence in incident response management

A dedicated resource centre showcasing ISF resources to support organisations in preparing for and recovering from business disruption events.

research

Department Finance Benchmark 2024

Make informed decisions and drive cost-effectiveness with powerful C-suite department benchmarking data from 200 global organisations.

research

Leadership Insights: Exploring the role of the Business Information Security Officer (BISO)

Discover how BISOs can support your ambitions to better connect security with the business and instil a strong security culture.

research

Manage Emerging Threats in 2024

Discover the critical threats to expect this year and how to present them in terms that the business can understand and act on in.

research

Leadership Insights: Unlocking the business value of security

Explore the historic business perceptions holding back security, and discover steps security leaders can take to accelerate positive change.

research

ICS Insights:
Challenging Manufacturers

Has your organisation considered the viable actions to reduce the risks posed if manufacturers are not carefully assessed and managed?

research

Embedding Security into Agile Development: Ten principles for rapid improvement

Agile software development methods are proving a better match for today's demanding business environments than…

research

Threat Horizon 2025: Scenarios for an uncertain future

Examine multiple contextual scenarios to help set strategies, prepare for potential threats and explore opportunities that lie ahead.

research

ISF Resources to Establish Confidence In Your Cyber Resilience

Demonstrate that the appropriate measures are being implemented to embed cyber resilience best practice with key ISF resources.

Resource Hub

research

Securing Your Supply Chain

Discover how the ISF equips you to respond to supplier risk challenges presented by today’s threat landscape.

research

Threat Intelligence:
React and prepare

Get to the core of what threat intelligence is and demonstrate the value it can provide if effectively managed.

research

ICS Insights:
Organic convergence

Has your organisation considered the complexity of environments within its ICS security controls?

research

Threat Horizon 2024: The disintegration of trust

Should organisations attempt to rebuild trust, or accept that it has disintegrated and adapt accordingly?

research

Cybersecurity Solutions for a Riskier World

A ThoughtLab study providing evidence-based insights into the most effective cybersecurity practices and investments.

research

Information Security in Mergers and Acquisitions

This excerpt from the full ISF briefing paper introduces a typical four-step process and helps promote the value of security in M&A activity.

research

The CISOs Role During Periods of Instability

Five Proactive Steps Towards Stabilisation

research

Rehearsing Your Cyber Incident Response Capability

Six Proactive Steps Towards Stabilisation

research

Securing the Supply Chain During Periods of Instability

As global pressure on supply chains increase significantly, explore five proactive and actionable steps towards stabilisation.

research

Managing Cyber Threats During Periods of Instability

Seven Proactive Steps Towards Stabilisation

research

Threat Horizon 2022: Digital and physical worlds collide

Threat Horizon 2022 presents nine potential threats across three themes driven by global events and major developments.

research

Demystifying Zero Trust

Zero trust continues to cause confusion across industries. Many vendors sell it as an off-the-shelf solution, but in reality, its successful implementation requires organisations to embark on a larger change programme.

research

Review and Gap Analysis of Cybersecurity Legislation and Cybercriminality Policies in Eight Countries

The ISF, in conjunction with CC-DRIVER, have released a report detailing new methods to prevent, investigate and mitigate cybercrime.

research

Legal and Regulatory Implications for Information Security: People's Republic of China

Read the latest ISF research on how the Personal Information Protection Law (PIPL) will affect organisations how CII operators must follow and report on data protection and security procedures.

research

Understanding the ransomware menace

The average cost to recover from a ransomware attack is $1.85 million. No sector is…

Download Now

research

Cyber Insurance: Is it worth the risk?

The cyber insurance market has sustainably grown in its relatively short history, but also displayed a volatility.

research

Securing Containers: Keeping pace with change

Organisational use of Containers has been increasing rapidly, rising from 23% to 92% in a 4-year period.

research

Security Architecture: Navigating complexity

Establish common architectural concepts, avoid common pitfalls, and integrate architecture into your information security function.

research

Preparing for the General Data Protection Regulation

The European Union’s General Data Protection Regulation (the GDPR) brings data protection legislation into line…

research

Extinction Level Attacks: A survival guide

A detailed, pragmatic approach that aids organisations in being better prepared and ultimately surviving an extinction-level attack

Resource Hub

research

Threat Horizon 2023: Security at a tipping point

Aimed at CISOs, senior leaders and risk executives, the Threat Horizon 2023 identifies nine future threats to information security grouped within three key theme

Download now

research

Human-Centred Security: Positively influencing security behaviour

Understand the key factors that influence behaviour, and learn how to deliver impactful security education, training and awareness.

research

Remote Working and Cyber Risk

As businesses emerge into the new world, beyond their response to the pandemic, we’re likely…

research

How the ISF Supports You in Securing European Railway Infrastructure

The ISF is committed to continually support businesses to stay cyber resilient and the railway sector is no exception. From our human-centred security research series, to our supply chain suite, we have something to support your needs as an organisation.

research

Continuous Supply Chain Assurance: Monitoring supplier security

Suppliers help to keep operations moving for all organisations, but this also brings information risk that you must keep a watchful eye on.

research

Becoming a next-generation CISO

As organisations undergo digital transformation to make themselves more responsive, CISOs are coming under pressure to help these far-reaching changes succeed.

research

ISF CISO Briefing: Adapting to a New World

As countries implement exit strategies from lockdown, the fallout from COVID-19 has presented a complex set of interrelated factors, causing a ripple effect that impacts the global economy, every geographic region, and all industry sectors.

research

Securing the Supply Chain: Preventing your suppliers’ vulnerabilities from becoming your own

Sharing information with suppliers is essential for the supply chain to function. However information compromised…

research

Securing the IoT: Taming the Connected World

The Internet of Things (IoT) has exploded into the connected world and promises much: from…

research

Using Cloud Services Securely: Harnessing Core Controls

Cloud computing has evolved at an incredible speed and, in many organisations, has become entwined with the complex technological landscape that supports critical daily operations.

research

Demystifying Artificial Intelligence in Information Security

Whilst AI poses new information risks, it can also be used for good and should become a key part of every organisation’s defensive arsenal.

research

Human-Centred Security: Addressing psychological vulnerabilities

Human-centred security starts with understanding humans and their interaction with technologies, controls and data.

research

Securing Mobile Apps: Embracing mobile, balancing control

The availability of mobile apps and mobile devices presents organisation with a conundrum. On the…

research

Industrial Control Systems: Securing the systems that control physical environments

With so many global organisations heavily reliant on Industrial Control Systems (ICS) to support business operations, senior business managers and boards are now encountering growing pressure to improve and maintain the security of their organisations ICS Environments.

research

Delivering an Effective Cyber Security Exercise

Performing cyber security exercises can help organisations improve their ability to detect, investigate and respond to cyber attacks in a timely and effective manner.

research

Threat Horizon 2021: The digital illusion shatters – Full report now available to download

The world is now heavily digitised. Technology enables innovative digital business models and society is…

research

Building A Successful SOC: Detect Earlier, Respond Faster

Building a successful Security Operations Centre (SOC) can greatly enhance the ability to detect and disrupt cyber attacks, protecting the business from harm.

research

Blockchain and Security: Safety in Numbers

Understanding the potential security risks related to blockchain and how they can be addressed, is vital for any organisation planning to use it as the basis for developing applications.

research

Engaged Reporting: Fact and fortitude

Now that cyber security has the attention of the board and information risk is on the agenda, CISOs are being asked increasingly tough questions about security investment and risk.

research

Engaging with The Board: Balancing cyber risk and reward

When boards and CISOs engage successfully, organisations are better able to take advantage of the…

research

Establishing A Business-Focused Security Assurance Programme: Confidence In Controls

How secure is your organisation’s information? At any given moment, can a security leader look an executive in the eye and tell them how well business processes, projects and supporting assets are protected?

research

Building Tomorrow’s Security Workforce

Business and security leaders today must actively work to build and sustain a robust security workforce, as shortfalls in skills and capability to manage risk can manifest as major security incidents that damage organisational performance, reputation and image.

research

Data Leakage Prevention (DLP)

The increasing adoption of collaboration platforms, cloud services and social media, which are often accessed using personal devices, has introduced a host of new ways for sensitive data to leak.

research

Managing the Insider Threat: Improving Trustworthiness

The insider threat has intensified as people have become increasingly mobile and hyper-connected. Almost every worker has multiple devices that can compromise information instantly and at scale: impact is no longer limited by the amount of paper someone can carry.

research

Data Privacy in the Cloud: Enabling business agility by managing risk

With cloud-based systems come inherent challenges. These are further complicated as data subject to privacy regulation inevitably moves into the cloud.

Protecting The Crown Jewels: How to Secure Your Mission-Critical Information Assets

Cyber Awareness: Kickstart your security culture

AI Insights: AI security governance

AI Insights: AI ethics and transparency

AI Insights: Agentic AI

ISF: Your first line of defence in safeguarding your organisation

ISF: Your first line of defence in supplier security risk management

ISF: Your first line of defence in incident response management

Department Finance Benchmark 2024

Leadership Insights: Exploring the role of the Business Information Security Officer (BISO)

Manage Emerging Threats in 2024

Leadership Insights: Unlocking the business value of security

ICS Insights: Challenging Manufacturers

Embedding Security into Agile Development: Ten principles for rapid improvement

Threat Horizon 2025: Scenarios for an uncertain future

ISF Resources to Establish Confidence In Your Cyber Resilience

Securing Your Supply Chain

Threat Intelligence: React and prepare

ICS Insights: Organic convergence

Threat Horizon 2024: The disintegration of trust

Cybersecurity Solutions for a Riskier World

Information Security in Mergers and Acquisitions

The CISOs Role During Periods of Instability

Rehearsing Your Cyber Incident Response Capability

Securing the Supply Chain During Periods of Instability

Managing Cyber Threats During Periods of Instability

Threat Horizon 2022: Digital and physical worlds collide

Demystifying Zero Trust

Review and Gap Analysis of Cybersecurity Legislation and Cybercriminality Policies in Eight Countries

Legal and Regulatory Implications for Information Security: People's Republic of China

Understanding the ransomware menace

Cyber Insurance: Is it worth the risk?

Securing Containers: Keeping pace with change

Security Architecture: Navigating complexity

Preparing for the General Data Protection Regulation

Extinction Level Attacks: A survival guide

Threat Horizon 2023: Security at a tipping point

Human-Centred Security: Positively influencing security behaviour

Remote Working and Cyber Risk

How the ISF Supports You in Securing European Railway Infrastructure

Continuous Supply Chain Assurance: Monitoring supplier security

Becoming a next-generation CISO

ISF CISO Briefing: Adapting to a New World

Securing the Supply Chain: Preventing your suppliers’ vulnerabilities from becoming your own

Securing the IoT: Taming the Connected World

Using Cloud Services Securely: Harnessing Core Controls

Demystifying Artificial Intelligence in Information Security

Human-Centred Security: Addressing psychological vulnerabilities

Securing Mobile Apps: Embracing mobile, balancing control

Industrial Control Systems: Securing the systems that control physical environments

Delivering an Effective Cyber Security Exercise

Threat Horizon 2021: The digital illusion shatters – Full report now available to download

Building A Successful SOC: Detect Earlier, Respond Faster

Blockchain and Security: Safety in Numbers

Engaged Reporting: Fact and fortitude

Engaging with The Board: Balancing cyber risk and reward

Establishing A Business-Focused Security Assurance Programme: Confidence In Controls

Building Tomorrow’s Security Workforce

Data Leakage Prevention (DLP)

Managing the Insider Threat: Improving Trustworthiness

Data Privacy in the Cloud: Enabling business agility by managing risk

Cyber Awareness:
Kickstart your security culture

ICS Insights:
Challenging Manufacturers

Threat Intelligence:
React and prepare

ICS Insights:
Organic convergence