Facing record CVE volume, NIST is overhauling how it runs the National Vulnerability Database, saying it will stop enriching ‘lowest priority’ CVEs so it can keep pace with the flood of new vulnerabilities.
Annual penetration tests satisfy the baseline SOC 2 standard, but this article explains why Penetration Testing as a Service offers a more cost-effective path to continuous compliance and audit readiness.
How PTaaS Helps Organizations Maintain Continuous SOC 2 Compliance Cost-Effectively Read More »
A newly uncovered phishing-as-a-service platform called VENOM has been targeting C-suite executives’ Microsoft credentials since at least November 2025, using techniques built to bypass multi-factor authentication.
HIPAA never explicitly requires penetration testing, but its Security Rule creates risk-management expectations that make it practically essential. This article breaks down what security teams actually need to know.
Does HIPAA Require Penetration Testing? What Security Teams Need to Know Read More »
Attackers are exploiting GitHub’s own notification system, posting fake VS Code security alerts in the Discussions section of thousands of repositories to trick developers into downloading malware.
GitHub Notifications Are Being Weaponized to Deliver Malware at Scale Read More »
Most teams that think they have dark web coverage only have dark web alerting, and that gap is exactly where threat actors operate. This piece explains the difference between monitoring and analysis, and what real coverage requires.
Poland’s National Centre for Nuclear Research disclosed an attempted breach of its IT infrastructure, detected and blocked before any damage occurred, with early suspicion pointing to Iranian threat actors.
Poland’s Nuclear Research Centre Repels Cyberattack, Potential Iran Attribution Read More »
Many DevSecOps programs look complete on paper, SAST and SCA deployed, scans running on every commit, yet findings still pile up unclaimed. This article explains how to build a program that actually works, and what to outsource.
How to Build a DevSecOps Program, and What to Outsource Read More »
From fabricated resumes and interview deepfakes to covering their tracks after a breach, Microsoft Threat Intelligence details how attackers are weaving AI into nearly every stage of an attack.
Penetration testing ROI is one of the most underreported metrics in cybersecurity, mostly because teams measure the wrong things. This framework shows how to track real outcomes instead of activity metrics.
How to Measure ROI from Your Penetration Testing Program Read More »
Operationalizing CTEM in Modern Security Programs
Learn how modern security teams can move beyond finding exposures and operationalize every stage of Continuous Threat Exposure Management.
Free registration · Live discussion and Q&A