Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1292 articles
An explainer on encryption, its symmetric and asymmetric forms, uses in protecting data, misuse by ransomware operators and infostealers, and enterprise practices such as strong algorithms and secure key management.
A commentary on Bruce Schneier’s DEF CON talk argues that AI broadens hacking beyond software, amplifies its speed and scale, and makes data integrity a central security challenge as AI systems affect real-world decisions.
Nol8 CEO Kelly Herrell recommends mapping AI agents’ data paths and enforcing runtime policies to control what sensitive information agents can access, receive, and disclose.
A vendor-authored guide compares six CodeQL alternatives, weighing setup, cross-file analysis, finding noise, workflow, coverage, and cost. It highlights CodeQL database-build limitations and promotes Aikido while discussing competing tools.
A six-stage guide to SASE adoption recommends assessing infrastructure, piloting in controlled environments, migrating workloads gradually, redesigning policies, training teams, and continuously reviewing security and performance.
The article explains how Microsoft’s public SSPR portal can expose whether accounts exist and, for some users, their registered reset methods. It describes the risks, limitations, an automation tool, and defensive measures.
Auburn University’s McCrary Institute leaders propose an AI Assurance Compact focused on capability, control and continuity, including independent evaluations, incident reporting and tested fallback plans for critical systems.
Rapid7 explains how dynamic application security testing can reproduce and validate weaknesses in running applications, helping teams prioritize exposure and provide developers with evidence for remediation.
A hands-on review found Scamwise flagged a phishing email, assessed a legitimate website as safe, and gave an indeterminate result for a phone number. The service explains its verdicts, but they are not guarantees.
The article explains five uses for continuous, AI-agent-driven red teaming: mapping attack paths, validating detections, testing identity blast radius, retesting pentest findings, and emulating threat actors.
Securonix argues that ISO/IEC 42001 governance must continue after AI deployment, with clear ownership, reassessed risks, access controls, monitoring, audit trails and recovery measures as agents and their capabilities change.
The article explains the CRA’s mandatory reporting deadlines, who must report exploited vulnerabilities or severe incidents, how the Single Reporting Platform works, and upcoming standards ahead of full compliance in 2027.
A static-analysis walkthrough extracts five files from a fake GlobalProtect MSI and recovers VBA from an encrypted Word document, showing configured installer actions and a staged macro chain while distinguishing source evidence from execution.
Organizations are shifting existing cybersecurity budgets toward AI security and agentic SOCs. The article highlights growing needs for agent visibility and identity controls, and warns that inefficient agents can drive up compute costs through excess reasoning and tool
Cofense argues that phishing defense should measure employees’ ability to recognize threats and connect that competency with real-world phishing and remediation signals, rather than relying on training completion or risk scores alone.
The author says ShinyHunters hacked a dark-web site associated with the Clop group, claims to have stolen data, and is demanding a ransom, and reflects on the impact of cybercriminal groups targeting one another.
A hands-on walkthrough shows how Impacket’s tstool uses MSRPC to enumerate and control Windows sessions, hijack an RDP session, and authenticate with hashes, Kerberos keys, or tickets, followed by mitigation advice.
The article argues that AI agents amplify gaps in SOC telemetry, context, baselines, and safeguards. It outlines a staged approach to agentic threat hunting, emphasizing reliable data and bounded actions before increasing autonomy.
Zimperium argues agentic AI can lower the skill and time needed to reverse-engineer mobile apps, bypass protections, automate app interactions and scale fraud, while relying on existing attack techniques rather than a new vulnerability class.
Matthew Rosenquist warns that autonomous AI weapons, including cyber variants, could be deliberately used against civilians, societies, and critical infrastructure, and urges international policymakers to establish boundaries before such capabilities scale.
Comcast Global CISO Noopur Davis describes her unplanned path from software development into cybersecurity leadership and shares views on business alignment, calm crisis management, cohesive teams, and giving staff time off after intense work.
A practical guide to India's DPDPA security duties explains safeguards, breach reporting, monitoring and audit requirements, and how security validation can help organizations test controls and document improvements.
The article outlines enterprise security questions for mobile AI, including where data is processed, who controls cloud use, whether AI is tied to managed identities, and whether devices can be trusted.
OneTrust CISO Tim Mullen argues that ISO 27001 should be a foundation, not the finish line, for AI-era risk management. He recommends connecting risk decisions to business context, standardizing before automating, and continuously monitoring control effectiveness.
