Debunking Security 'Myths' to Address Common Gaps

RSAC 2025 session recap: speakers warned that MFA, while valuable, is insufficient alone and must be part of a layered defense; organizations should move beyond checkbox third‑party questionnaires to focus on the most critical suppliers (highlighted by a CrowdStrike update outage example); cyber insurance is increasingly influencing compliance decisions; and the CISO role is shifting toward business and change‑management leadership rather than purely technical responsibilities.