Researchers say the JadePuffer campaign is the first fully documented ransomware attack run start to finish by an AI agent, with no human at the keyboard, after breaking in through an old, unpatched Langflow flaw.
JadePuffer Ransomware Let an AI Agent Run the Entire Attack, Start to Finish Read More »
“You’ve shown me forty thousand vulnerabilities closed. What I need to know is whether we’re less likely to get breached.” That question is why activity metrics like scan counts and patch totals are losing credibility in the boardroom, and what CISOs should track instead.
The Five Metrics CISOs Should Stop Measuring, and What to Use Instead Read More »
A critical flaw on your payment server and the same CVE on an air-gapped dev box get identical CVSS scores, but they are not the same risk. Here’s why prioritizing by asset value, not severity alone, changes what gets fixed first.
Why Asset Value Should Drive Your Vulnerability Prioritization Read More »
The invitation emails are genuinely sent from OpenAI’s own servers. Researchers found attackers creating fraudulent OpenAI tenants to lure employees at cybersecurity and tech firms into feeding sensitive data straight into an attacker-controlled workspace.
Attackers Are Using Fake OpenAI Organizations to Target Cybersecurity and Tech Firms Read More »
You patched it, verified the fix, and closed the ticket. Three months later, the same CVE lit up your scanner again. Here are the five root causes behind vulnerability recurrence, and what “fixed for good” actually requires.
The Vulnerability Came Back. Here Are Five Reasons Why. Read More »
A breach at a third-party vendor exposed driver’s license numbers, passport numbers, and contact details for over 3 million Texas hunting and fishing license holders, exactly the data attackers need to run convincing phishing campaigns.
Texas Data Breach Exposes Over 3 Million Hunting and Fishing License Customers Read More »
If even a quarter of a SOC analyst’s time goes to findings that need no action, that’s a real dollar cost on top of the burnout and missed real threats. Here’s what false positives actually drain from a security program, and how to fix it.
What Do False Positive Security Findings Actually Cost? Read More »
Certificates, API keys, service accounts, and tokens now outnumber human logins many times over in the average enterprise, and AI agents are adding to that pile faster than most security teams can govern it.
How Machine Identities Are Expanding the Modern Attack Surface Read More »
Falling cyber insurance premiums sound like good news, but Gartner analysts say carriers are quietly stripping coverage for social engineering, war exclusions, and mass events, exclusions many policyholders won’t notice until they need to file a claim.
Cyber Insurance Rates Are Falling, But the Fine Print Could Leave You Exposed Read More »
A malicious ad for “chatgpt” leads not to a fake site but to a real chatgpt.com share link, one that every URL reputation checker trusts. Researchers detail how the LLMShare campaign hides malware delivery behind ChatGPT and Claude’s own domains.
Attackers Are Weaponizing ChatGPT and Claude Share Links to Deliver Malware Read More »
Operationalizing CTEM in Modern Security Programs
Learn how modern security teams can move beyond finding exposures and operationalize every stage of Continuous Threat Exposure Management.
Free registration · Live discussion and Q&A