Articles
How to Choose a “Mobilization First” Vulnerability Management Platform
Most organizations no longer struggle to find vulnerabilities, they struggle to mobilize remediation. This article explains what to look for in a vulnerability management platform built around getting fixes actually done, not just found.
VMware ESXi Zero-Days Likely Exploited More Than a Year Before Disclosure
New research from Huntress indicates VMware ESXi zero-days were actively exploited more than a year before Broadcom’s official advisory, pointing to a mature exploit chain already in use since early 2024.
How to Deploy AI Assistants Effectively in Cybersecurity Operations
AI assistants promise faster analysis and reduced alert fatigue, but many security teams find that simply adding AI to existing workflows doesn’t improve outcomes. This article covers which AI agents to deploy, where, and how to maximize their value.
Chinese State-Linked Threat Actors Rapidly Expand Exploitation of React2Shell RCE
Google’s Threat Intelligence Group has confirmed that additional Chinese and Iranian state-linked groups are now exploiting the maximum-severity React2Shell remote code execution flaw to gain rapid access to cloud infrastructure.
What is Attack Path Mapping & Analysis?
Attackers rarely reach their target in a straight line, instead chaining together misconfigurations, identity flaws, and overlooked trust relationships. This article explains how attack path mapping reveals those chains and drives real risk reduction.
North Korea Renting Engineers’ Identities to Breach Fortune 500 Companies
North Korea’s state-backed hackers have found a new way into Fortune 500 companies: recruiting real software developers to rent out their identities so DPRK operatives can land remote IT jobs under false pretenses.
How to Assign Business Risk to Vulnerabilities (And Why CVSS Alone Fails)
CVSS scores tell you how severe a vulnerability is in isolation, not whether it actually threatens your business. This article explains how to assign real business risk to vulnerabilities and where CVSS alone falls short.
Comcast Fined $1.5M After Vendor Breach Exposes Data of 270K Customers
Comcast will pay a $1.5 million FCC fine after a breach at former vendor FBCS exposed the personal data of more than 270,000 customers, a scope the vendor only acknowledged months after first denying any impact.
CrowdStrike Confirms Insider Fed Information to Hackers
CrowdStrike has confirmed an employee shared internal screenshots with external threat actors after the images surfaced on Telegram channels tied to Scattered Lapsus$ Hunters, though the company says no systems were breached and customer data was unaffected.
How to Communicate Cyber Risk with Boards Effectively
Many CISOs have the data but struggle to translate it into terms boards can act on. This practical guide explains how cybersecurity leaders can communicate risk in ways that strengthen board decision-making rather than confuse it.
Jaguar Land Rover Cyberattack Drives Over $220 Million in Losses
Jaguar Land Rover has disclosed £196 million ($220 million) in losses tied to the cyberattack that crippled its operations earlier this year, making it one of the costliest cyber incidents to hit a global manufacturer in recent memory.
Five Best Practices for Strong API Security
APIs now connect everything from customer portals to payment systems, and that ubiquity has made them one of the most frequently targeted points of attack. This article covers five best practices for strengthening API security.