Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1296 articles
Black Kite’s 2026 report says over 48,000 CVEs were published in 2025, but only 58 of 1,024 prioritized CVEs were readily discoverable to attackers. The article examines shrinking patch windows, AI-related exposure and visibility gaps.
A lab walkthrough demonstrates how Nmap scans evade static iptables rules by varying TCP flags, packet length, TTL, source fields, payloads and options. It recommends stateful inspection, IDS/IPS, rate limiting and host monitoring.
Huntress describes how its teams use Managed SIEM to investigate incidents, correlate logs, and detect threats. In one case, EDR stopped a malware infection and SIEM logs helped confirm no data was exfiltrated.
The article recommends preparing to secure AI applications before they reach production by involving security teams early, strengthening operational workflows, maintaining application and API security, and adding proactive scanning and AI-aware runtime monitoring.
Practitioners recount ICS/OT risks including IT-to-OT access attempts, a scan that stopped turbines, internet-reachable systems with default credentials, hidden assets and suspicious DNS traffic. Their experiences underscore inventory, monitoring and careful network and
Huntress explains that RaaS affiliates use varied access and intrusion methods, so a ransomware brand alone does not reveal an attack’s path. It highlights common tactics and recommends broad monitoring and sound security fundamentals.
The article says EvilTokens used OAuth consent phishing to obtain refresh tokens from users at more than 340 Microsoft 365 organizations. The tokens could evade MFA protections and survive password resets; recommended defenses include grant monitoring and token-level re
A hands-on NetExec tutorial walks through compromising a Windows Server 2019 Active Directory lab from low-privileged credentials to domain control and SYSTEM on an MSSQL host, then maps the chain to hardening and detection measures.
The article maps LLM security failures to confidentiality, integrity and availability, describing prompt and chat-history leaks, prompt injection and poisoning, and costly inference DoS. It also argues the triad misses probabilistic and cognitive risks.
The article reports campaigns targeting secrets in developer environments and CI/CD across npm, PyPI and Docker Hub, and argues that workstations should be treated as a local software supply chain boundary.
An op-ed says ShinyHunters used compromised Free-For-Teacher accounts to breach Canvas and steal data, arguing for stronger identity governance, reduced access, cryptographic protections and post-quantum planning.
The article argues that growing non-human identities (NHIs), including service accounts, tokens and AI agents, create security and compliance risks when ownership, lifecycle controls and auditability are weak; it recommends governance beyond secret vaulting.
AI agents can misuse delegated credentials, follow prompt-injection instructions, and trigger rapid changes. The article recommends inventorying agents, assigning owners, limiting permissions by action, gating risky operations, and keeping linked audit evidence.
The article argues that combining AI with threat intelligence could help defenders prioritize real exposure, anticipate attacker actions and deploy adaptive deception, while warning about containment, governance and intelligence-quality risks.
Huntress discusses how security teams can improve resilience by reducing alert noise, clarifying ownership, strengthening identity and asset visibility, and pairing security tools with workflows that support timely response.
An overview of single sign-on (SSO), explaining its authentication flow, common protocols, benefits and risks, and considerations for implementing it securely, including MFA, session timeouts, and least privilege.
An overview of 19 cloud security risks, including misconfigurations, excessive access, account hijacking, insecure APIs, ransomware and MFA fatigue, with basic guidance on limiting access and monitoring cloud settings.
NMFTA explains how criminals use phishing, compromised email and fraudulent carrier identities to reroute freight, and recommends stronger authentication, out-of-band verification and industry-focused security guidance.
A LABScon25 presentation examines whether public indicators of cyber breaches can anticipate market reactions, testing a “15/30” trading hypothesis with breach disclosures and time-series analysis. Results were mixed.
The article reviews extortion incidents involving Vastaamo, Salesforce-connected data, Jaguar Land Rover and Oracle E-Business Suite, then outlines steps organizations can take to contain breaches, investigate exposure and notify affected parties.
A guide to CMMC requirements for DoD contractors, covering certification levels, rollout and subcontractor flow-downs, Level 2 assessment expectations, and steps organizations can take to prepare.
An Incode strategy executive argues that AI-enabled impersonation and synthetic-identity fraud require defenses updated within 7–10 days, and urges enterprises to assess identity-verification vendors on certifications, error reporting, update speed and intelligence分享.
A CISSP study guide offers a scenario-based way to distinguish security models by whether they protect confidentiality or integrity, explaining Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Graham-Denning, and Take-Grant.
Drawing on an Intezer AI SOC event, the author argues that AI is changing SOC operations, security budgets and vendor contracts. The article highlights a proposed executive metric, AVERT, and the importance of mature SOC foundations.
