Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1294 articles
The article compares six enterprise AI pentesting platforms across application, API, mobile, AI and infrastructure coverage, finding validation, deployment and pricing. It includes vendor claims, a cited independent test and tool-selection guidance.
A comparison of seven container image hardening tools explains their approaches to minimizing and patching images, trade-offs around migration and updates, and criteria such as provenance, end-of-life coverage, and remediation intelligence.
A guide explains how attackers take over accounts through stolen credentials, phishing, session theft, and other methods, then outlines signs to watch for and defenses including MFA, EDR, password managers, and access controls.
The article argues that organizations must pair AI-agent governance with continuous monitoring, distinct identities, limited permissions and human oversight to ensure agents’ real-world behavior remains aligned with business intent.
The article surveys surveillance by companies, employers, criminals and governments, arguing AI expands data collection and inference. It highlights infostealers’ theft of credentials and session tokens, risks from data aggregation, and concerns about bias, privacy and
Aikido outlines criteria for assessing AI pentesting vendors, including live validation, testing depth, code access, reliability, scope controls and workflow fit. It recommends comparing vendors through monitored, comparable test runs.
CIS shares lessons from supporting security operations at FIFA World Cup 2026: build partnerships early, establish trusted information-sharing pathways, and assess emerging threats before, during, and after major events.
The guide compares DAST tools on authenticated testing, API coverage, finding verification and workflow integration. It explains DAST’s runtime strengths and limitations, including its difficulty detecting business-logic flaws, and offers selection criteria.
Huntress argues that AI can help build and analyze security detections, but people must define and run checks to catch faulty conclusions, measure false positives, and decide whether rules are safe to ship.
XBOW CISO Nico Waisman discusses his career in offensive security, CISO pressures, and his concern that falling AI costs could enable attackers to use autonomously adapting malware at scale.
Aikido's vendor-authored guide compares Snyk with Aikido, GitHub Advanced Security, GitLab Ultimate, Semgrep and Opengrep, Checkmarx, Veracode, and SonarQube, outlining claimed capabilities, gaps, and tradeoffs.
ThreatFabric explains how behavioural analytics combines user interaction patterns with device-risk signals to help banks identify scams, account takeover and other fraud throughout a customer’s digital journey.
Mandiant describes AVDH, a multi-agent harness for source-code vulnerability discovery that combines threat modeling, code analysis, validation, and human review. The company says it found more than 100 critical vulnerabilities in two days during an incident response.
The article describes how prompt injection, autonomous AI actions and AI-assisted supply-chain attacks can expose DevOps data or disrupt infrastructure, citing GitProtect Lab figures and recommending least privilege, isolation, auditing and resilient backups.
The article examines security risks involving AI coding tools, exposed logs and storage, and autonomous agents, then recommends enterprise controls spanning data, identity, endpoints, applications and processes.
Cofense describes mass-distributed email scams impersonating familiar brands, using urgent purchase or password-reset alerts to push recipients to call fraudsters. AI can help generate convincing variations, and some lures link to fake invoices.
A practical guide to using Impacket SMBExec for remote Windows command execution with passwords, hashes, and Kerberos credentials, plus recommendations for limiting and detecting its use.
Recent attacks on water utilities highlight risks from exposed OT, weak visibility, and poorly governed vendor access. The article outlines steps to improve resilience, including asset inventories, network segmentation, tested response plans, and manual fallback.
The article explains how AI agents can create new paths to sensitive data and outlines ways to map access, validate exploitable risk, prioritize exposure, and remediate it.
Aikido compares software supply chain security tools, covering dependency scanning, malicious package detection, artifact signing and SBOMs. The vendor-authored guide promotes Aikido alongside alternatives.
A sponsored Material Security article argues that attackers can use stolen OAuth tokens to access Gmail and Drive, while overpermissioned AI agents may follow similar paths. It recommends monitoring OAuth activity, limiting data access and protecting reset links.
The article compares six platforms for unified code, cloud, runtime and endpoint security, outlines selection criteria, and cites Aikido report data linking larger tool stacks with more incidents and slower remediation.
The article compares seven enterprise DAST platforms across authenticated testing, API discovery, exploit validation, governance, and pricing, and explains why continuous DAST should be paired with penetration testing for business-logic flaws.
A vendor-authored guide compares seven enterprise SCA tools across malicious-package intelligence, reachability, remediation, governance and SBOMs. It favors Aikido and presents its performance claims as vendor claims.
