Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1296 articles
Stripe’s Vincent Passaro describes FT3, a framework modeled on MITRE ATT&CK that gives fraud teams a shared language, and explains how infrastructure targeting and law-enforcement collaboration support efforts to disrupt fraud.
StepSecurity describes risks across AI-assisted development and promotes controls for developer machines, npm dependencies, and CI/CD, including package monitoring, runtime visibility, behavioral baselines, and egress enforcement.
The article explains how security teams can connect controls and threats to business outcomes using the Threat and Safeguard Matrix (TaSM), executive scorecards, and related workshop materials.
Wiz and Infosys describe a reference architecture using MCP and specialized agents to investigate cloud risks and propose remediation, with human approval required for high-impact actions.
CIS outlines how its managed detection and response service provides round-the-clock endpoint monitoring, threat triage, containment, and remediation guidance to help U.S. public utilities defend IT and OT environments.
The article explains how cloud providers can use automated asset visibility, contextual risk prioritization, and evidence collection to support FedRAMP continuous monitoring, while promoting Wiz for Gov as a tool for these tasks.
Huntress cites hiring-fraud figures, including 23.2% of applicants flagged as fraud risks in its September–November 2025 data, and recommends identity checks and contextual assessments to reduce deepfake and insider-threat risks.
An explainer distinguishes information security’s protection of data in physical and digital forms from cybersecurity’s focus on digital threats, then offers practical security hygiene steps for home and work.
Rabobank’s external fraud lead discusses AI-scaled social engineering, targeted age groups, coaching-based crypto investment scams, and a new AI model being rolled out in 2026 to detect fraud patterns.
A phased roadmap introduces Linux fundamentals, command-line and virtual-machine practice, then security-focused distributions and tools for controlled cybersecurity labs.
The article outlines romance, florist, ticket and phishing scams that exploit Valentine’s Day, and offers advice for avoiding fraud, malicious links and requests for money or personal information.
The article explains how banks can move fraud detection earlier than the payment stage by using threat intelligence and user-journey signals such as malware, remote access, risky calls, location anomalies, and behavioral changes.
OpenClaw can handle sensitive tasks but may expose users to risks from largely unreviewed code, malicious skills, and prompt injection. The article advises testing it in an isolated system without sensitive data or transaction access.
The article argues that security-awareness training can improve security when it is ongoing, practical, interactive, and non-punitive, rather than a one-off annual lecture and test.
The article surveys cyber operations linked to conflicts in Syria, Georgia, Ukraine and Venezuela, arguing that states use them to disrupt air defenses, communications and infrastructure before or during military action.
Fortinet's Aamir Lakhani says generative and agentic AI could help attackers automate and adapt attacks, while urging defenders to focus on attack intent, network impact and business-critical systems rather than relying mainly on IOCs.
The article recommends taking stock of digital-service dependencies and gradually exploring alternatives for messaging, social networks, and cloud storage, while weighing usability, privacy, and the effort of self-hosting.
A technical walkthrough explains how Windows ProjFS uses a minifilter and provider to virtualize files, control some file operations, vary read results by process, and support file-access canaries.
PayPal’s fraud and threat intelligence chief urges teams to combine their expertise. He highlights OTP theft via phishing pages, phishing-as-a-service and AI-generated fake shops, and points to anomalies, customer complaints and infrastructure as fraud signals.
The article recommends seven tools for adding automated API and application security scanning to CI/CD pipelines, including OWASP ZAP, Snyk, Burp Suite, Checkmarx, SonarQube, Trivy, and StackHawk.
A virtual workshop on March 31, 2026, will guide participants through using the OWASP Threat and Safeguard Matrix to prioritize organizational threats, map defenses across the NIST CSF, measure progress, and justify security budgets.
Wiz’s 2025 research roundup highlights supply-chain campaigns, exposed AI-related data and critical infrastructure vulnerabilities, including attacks that spread through npm and GitHub and flaws affecting React, Ingress NGINX and Redis.
Team Cymru describes using its Pure Signal data in OpenCTI through Scout connectors, with example queries for investigating VPN use, AnyDesk-tagged infrastructure and PiKVM devices, plus Playbooks for scheduled hunts and dashboards.
A cybersecurity startup guide to building trust and growth through channel partners, industry analysts, consulting firms, and security marketplaces, emphasizing direct sales and customer references as a foundation.
