Articles
Instructure Pays Off ShinyHunters to Contain Massive Canvas Data Breach
Instructure, the company behind the Canvas learning management system, paid the ransomware group ShinyHunters after a second breach exposed 3.6 terabytes of data and defaced login pages across its platform.
Why Security Backlogs Persist and How to Shrink Them: A Practical Playbook for Modern Teams
Vulnerability scanners, pentest reports, and compliance audits keep feeding the same backlog that never shrinks. This playbook explains why security backlogs persist and how to turn an unmanageable queue into a measurable, risk-driven program.
Two Americans Sentenced for Running ‘Laptop Farms’ That Helped North Korean IT Workers Infiltrate U.S. Companies
Two U.S. nationals were sentenced to prison for running ‘laptop farms’ that let North Korean IT workers pose as remote U.S. employees, infiltrating nearly 70 companies and funneling over $1.2 million back to the regime.
Building a CTEM Program Cost-Effectively: How to Get 90% of the Value from 10% of the Spend
You don’t need a seven-figure security stack to run Continuous Threat Exposure Management. This guide shows how organizations can capture most of CTEM’s value from a fraction of the typical spend.
North Korea Quietly Walked Off With 76% of 2026’s Stolen Crypto Using Only Two Attacks
New TRM Labs data shows North Korea-aligned hackers now control roughly 76% of all cryptocurrency stolen worldwide this year, achieved not through more attacks but through fewer, smarter, AI-assisted operations.
Why Security Is a Process Problem, Not a Technology Problem
Layering EDR on XDR on SIEM on SOAR hasn’t stopped breaches from getting worse. This article argues that security’s real weakness isn’t a lack of tools, but a lack of process discipline.
CanisterWorm Hijacks Namastex Labs npm Packages in Self-Spreading Supply Chain Attack
A self-replicating npm worm has hijacked packages tied to AI agent tooling company Namastex Labs, harvesting developer secrets and automatically republishing itself across every package a victim can access.
Exposure Management vs Vulnerability Management: A Complete Guide
As attack surfaces stretch across cloud, SaaS, IoT, and third-party integrations, this guide compares exposure management and vulnerability management to show how combining both delivers broader visibility and stronger prioritization.
NIST Overhauls NVD Operations, Will Stop Enriching “Lowest Priority” CVEs Amid Record Volume
Facing record CVE volume, NIST is overhauling how it runs the National Vulnerability Database, saying it will stop enriching ‘lowest priority’ CVEs so it can keep pace with the flood of new vulnerabilities.
How PTaaS Helps Organizations Maintain Continuous SOC 2 Compliance Cost-Effectively
Annual penetration tests satisfy the baseline SOC 2 standard, but this article explains why Penetration Testing as a Service offers a more cost-effective path to continuous compliance and audit readiness.
VENOM Phishing Platform Targets C-Suite Executives, Bypasses MFA to Steal Microsoft Credentials
A newly uncovered phishing-as-a-service platform called VENOM has been targeting C-suite executives’ Microsoft credentials since at least November 2025, using techniques built to bypass multi-factor authentication.
Does HIPAA Require Penetration Testing? What Security Teams Need to Know
HIPAA never explicitly requires penetration testing, but its Security Rule creates risk-management expectations that make it practically essential. This article breaks down what security teams actually need to know.
