Security Teams Need to Understand How Software Actually Gets Shipped

There used to be a fairly predictable starting point for a cybersecurity career. Learn networking. Understand access control. Get comfortable with security operations. Then, after some experience, start tackling the newer and more complicated stuff. AI is messing with that sequence. On 1 September 2026, ISC2 introduced its updated Certified in Cybersecurity exam outline, the first major content revision since the entry-level certification launched in 2022. Foundational AI concepts are now integrated into the material, including identifying AI assets, recognizing automated threats and supporting secure governance of emerging technologies. Its updated AI guidance goes further. Cybersecurity professionals increasingly need competence in AI governance, model security, data integrity, prompt engineering, AI risk management and the security of AI-enabled systems. That’s quite a list for something that was recently considered a specialist topic. AI SECURITY IS MOVING DOWN THE CAREER LADDER There’s a practical reason for this. AI-enabled systems are entering everyday business operations. At the same time, AI can be used for phishing, social engineering and increasingly automated attacks. Indonesia is already preparing for that reality.

INTRODUCTION As organizations accelerate digital transformation through cloud adoption, remote work, and AI-driven systems, the nature of cyber risk continues to evolve. Security challenges are no longer limited to technical vulnerabilities alone. Increasingly, attackers exploit human behavior, trust, and routine workflows to gain unauthorized access to systems and sensitive data. Phishing campaigns, social engineering tactics, and impersonation attacks have grown more sophisticated and harder to detect. Industry guidance from ENISA [https://www.enisa.europa.eu/] highlights that human-centric attack techniques remain among the most effective methods used against organizations today. In this context, cybersecurity awareness has become a critical factor in determining how effectively enterprises can prevent, detect, and respond to cyber threats. This article explains why cybersecurity awareness is important, the challenges enterprises face in building it, and how awareness strengthens overall cybersecurity resilience. WHAT IS CYBERSECURITY AWARENESS? According to findings highlighted in the Verizon Data Breach Investigations Report (DBIR), [https://www.verizon.com/business/resources/reports/dbir/]human interaction continues to play a significant role in successful cyber incidents. In enterprise environments, cybersecurity awareness is not limited to IT or security teams. It applies to every

INTRODUCTION Today, almost every organization relies on digital systems to run daily operations, from websites and cloud applications to payment systems and internal databases.  However, as digital infrastructure grows, so do cybersecurity risks. Attackers constantly look for vulnerabilities in applications, networks, and systems that they can exploit to gain unauthorized access or steal sensitive data (Cloudflare, 2024). Because of this growing threat landscape, organizations need ways to test their defenses before real attackers attempt to breach them. One of the most effective methods is penetration testing, often called pen testing, where cybersecurity professionals simulate attacks to identify security weaknesses before malicious actors do (IBM, 2024). In simple terms, penetration testing is authorized hacking designed to improve security rather than cause damage. Source: Cloudflare.com [https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/], ibm.com [https://www.ibm.com/think/topics/penetration-testing] WHAT IS PENETRATION TESTING? Penetration testing is a cybersecurity assessment where security experts simulate cyberattacks on systems to identify vulnerabilities that attackers could exploit. These experts that are often known as penetration testers or ethical hackers use techniques similar to real attackers, but with permission from the organization and with the goal