Field notes, threat analysis and long-form guidance from the people doing the work. Published as we learn it.
Eleven months after the first detailed account of an AI-orchestrated espionage campaign, agent-assisted attacks have become routine in threat reporting. A synthesis of what the year’s public reporting shows, and which defensive assumptions held up.
EU Cyber Resilience Act reporting begins September 11, and the U.S. CIRCIA final rule is expected soon. Together with existing SEC, NIS2, DORA and state requirements, many organizations will face several reporting clocks from one incident. How to prepare a single process that meets them all.
Days before the August 2 deadline, the EU’s Digital Omnibus pushed most high-risk AI obligations to late 2027. Organizations that were racing now have room to build the inventory, governance and security controls the obligations assume.
Nearly every security product now ships an AI assistant or agent, and the demos are impressive. The questions that show whether a feature will hold up in your environment, with your data and your team.
For the first time in the DBIR’s history, exploiting vulnerabilities is the leading way attackers get in. A look at what drove the shift, why faster patching alone won’t close the gap, and where exposure management should focus.
A destructive attack in March reportedly used a company’s own device management platform to wipe its devices. Admin planes can reach everything by design. Here’s how to protect them as the critical systems they are.
In a few weeks, attackers poisoned a security scanner, an AI gateway library and one of the most-used HTTP clients in JavaScript. The common thread was where those tools run, and what credentials sit beside them.
‘Hours saved’ is the most common way to justify security automation, and one of the least reliable. A set of measures that show whether automation is helping investigations, response and the team, with an illustrative example.
Agents are moving from pilots into daily work, and some are arriving without anyone deciding to deploy them. A practical starting point for governance: an inventory of the access each agent holds and the actions it can take.
Roadmaps get funded when they connect specific work to specific risks the business recognizes, in an order that makes sense. A practical structure for building one from the evidence you already have.
A maximum-severity flaw in React Server Components was exploited within hours of disclosure. The patch was straightforward. Finding every affected application across cloud accounts, hosting platforms and vendor products was not.
The first publicly documented espionage campaign run largely by an AI agent changes the tempo defenders should plan for. What the disclosure showed, what it didn’t, and how to adjust detection, triage and response.
A nation-state actor stole source code and undisclosed vulnerability details from a major network security vendor. For customers, the immediate work is patching. The longer-term work is deciding how architecture should account for vendor compromise.
September brought two major npm compromises in a week, one of them a worm that used stolen tokens to publish itself into hundreds of packages. An analysis of how it spread, and the controls that break the chain.
Attackers used OAuth tokens from a sales chat integration to export CRM data from hundreds of organizations, then searched it for more credentials. Most victims had strong login security. The tokens went around it.
The SharePoint exploitation wave stole cryptographic machine keys, so attackers could return after servers were patched. A timeline of the campaign, why key theft changes response, and what to check on any on-premises SharePoint farm.
A zero-click flaw in a major enterprise assistant showed how an email nobody opens can instruct an AI to send data out. A practical guide to the trust boundaries that retrieval-augmented assistants create, and the controls that hold up.
This spring’s retail and insurance intrusions started with phone calls, not exploits. Attackers convinced help desks to reset credentials and MFA. Here’s how to make the service desk a strong link in identity security.
Third-party involvement in breaches doubled. Ransomware showed up in more breaches even as fewer victims paid. Edge devices became a fifth of exploitation targets. What each shift should change in next year’s plan.
For about a day, it looked as if the system that names and tracks vulnerabilities would lose its funding. The contract was extended, but the scare exposed how many programs depend on a single upstream source. Here’s how to build in resilience.
The largest theft in cryptocurrency history didn’t break the exchange’s cold-wallet controls. It changed what the signers saw. The lessons apply to any organization that approves high-value actions through a vendor’s interface.
A new model topped the app stores in a week, and security teams were asked whether employees were using it. Most couldn’t answer quickly. Here’s how to build an AI usage inventory that keeps up.
The HHS proposal published January 6 would turn many long-standing ‘addressable’ safeguards into firm requirements. Healthcare organizations and their business associates can use the comment period to build a realistic plan, whatever the final text says.
VPN gateways, firewalls and management consoles produced the year’s most consequential exploitation. A review of the 2024 pattern, why conventional vulnerability programs under-weight these devices, and how to rebalance.
The telecom intrusions disclosed this month reached call records and lawful-intercept systems. For enterprises, the practical lesson is about where trust in a communications path should end.