Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

bitsight

DNS Servers & Cybersecurity: How They Work and How to Secure Them

Feb 28, 2025 By Sabrina Pagnotta In BitSight
The Domain Name System (DNS) is a fundamental component of the Internet, translating human-friendly domain names into IP addresses that computers use to communicate. While its primary function is straightforward, DNS servers play a crucial role in both the performance and security of online activities.
Read Post
kovrr

New Partnership Between metafinanz and Kovrr

Feb 28, 2025 By Kovrr In Kovrr
We are pleased to announce the strategic partnership between Kovrr and metafinanz. This collaboration brings together Kovrr’s on-demand cyber risk quantification (CRQ) solution and the expertise of the Munich-based business and IT consulting company metafinanz in delivering tailored CRQ services. Together, we are expanding our ability to help organizations in the DACH region strengthen cyber resilience and meet growing regulatory demands.
Read Post
cyberark

What's On the Horizon for AI Risk Management

Feb 28, 2025 By Kaitlin Harvey In CyberArk
Sam Altman’s recently published “Reflections” blog is one of those pieces that made me stop mid-scroll and wonder, “We’re really right in it, aren’t we?” Part think piece, part reality check, it’s a fascinating article that balances enthusiasm for AI’s potential with the very real warning signs flashing over all our heads.
Read Post
riscosity

Where the Shadows Lie

Feb 27, 2025 By David Schlesinger In Riscosity
Shadow technology, regardless of name, is a manifestation of the same issue - unmonitored, unauthorized, or hidden technology operating outside official oversight. Over the past ten years, with the adoption of SaaS services, Shadow IT became a significant concern for security teams. With the more recent explosion of AI tools, we’ve started to hear the term Shadow AI being used for the same reasons.
Read Post
trustcloud

Effective risk management and controls remediation planning

Feb 27, 2025 By Richa Tiwari In TrustCloud
Organizations face an increasingly complex landscape of risks in a business environment. From cybersecurity threats to regulatory challenges, the need for robust risk management and effective controls remediation has never been more critical. This article explores the vital process of control remediation planning, offering a strategic roadmap for mitigating risks, enhancing compliance, and safeguarding organizational success.
Read Post

From Zero to CTEM: An Actionable Approach to the Five Stages

Feb 26, 2025 By Nucleus In Nucleus
Join Nucleus team members Tali Netzer, Head of Product Marketing, and Scott Koffer, COO and Co-Founder, as they navigate the intricacies of Continuous Threat Exposure Management (CTEM). In this webinar, they discuss the history of vulnerability management, the evolution to CTEM, and how it fundamentally changes the approach to cybersecurity. Learn about the five-step CTEM process, from scoping and prioritization to validation and mobilization.
View Video

Security Without Tears: Making Threat Intelligence Actionable - Fireside Chat

Feb 26, 2025 By UpGuard In UpGuard
Dr. Kane Tomlin, CIO at Mississippi State Department of Health shares his innovative ‘Security Without Tears’ approach. Learn how he reduces complexity, prioritizes threats, and implements practical, citizen-focused security solutions at MSDH.
View Video
riscosity

Automating Data Privacy Confidence with a PIA

Feb 25, 2025 By Christopher Widstrom In Riscosity
A Privacy Impact Assessment (PIA) is a process that helps identify and manage any privacy risks that may arise from taking on new projects or systems that involve personally identifiable information (PII). PIAs are recommended by the EU’s General Data Protection Regulation (GDPR) and required for government agencies to perform under the U.S. E-Government Act.
Read Post
kovrr

Cybersecurity Performance Management and Measuring Cyber Risk Exposure

Feb 25, 2025 By Kovrr In Kovrr
Cybersecurity performance management (CPM) is the process of continually assessing and optimizing an organization's security posture. As cyber threats evolve, organizations must ensure their security measures are withstanding this increasing sophistication of ensuing attacks. However, with this rapid rate of change, traditional approaches to cybersecurity performance measurement, which often rely on static technical metrics, are failing to capture the broader business impact of cyber risks.
Read Post
securitysenses

Cybersecurity in Telecom: How Smart Expense Management Helps Mitigate Risks

Feb 24, 2025 By SecuritySenses In SecuritySenses
Telecom cyber attacks have evolved, leading to data exposure, unauthorized access, and financial loss. Poor security controls and unmanaged telecom expenditure typically leave firms vulnerable to fraud and abuse. Expense management is essential for detecting anomalies that can be used to identify security threats. Real-time telecom spending monitoring helps firms detect suspicious behavior, prevent unauthorized use, and enhance overall security. Proactive monitoring helps with both financial control and network security.
Read Post
bitsight

Data Gathering in Cybersecurity: Techniques, Best Practices, and Key Questions

Feb 21, 2025 By Sabrina Pagnotta In BitSight
In cybersecurity, the ability to gather, analyze, and act on data determines how well an organization can anticipate threats, detect vulnerabilities, and respond to attacks. But not all intelligence is created equal. Knowing what data to collect, where to find it, and how to interpret it is what separates reactive security teams from proactive ones.
Read Post
upguard

AI-Powered Cybercrime: Is Your Business Ready to Defend?

Feb 19, 2025 By Leah Sadoian In UpGuard
Artificial intelligence (AI) is one of the hottest buzzwords across industries, seemingly connected to almost every aspect of technology. AI models are helping software and tech products take their services to the next level, enhancing speed, accuracy, and efficiency. But this leap forward also introduces a deceptive shadow: AI-powered cybercrime. Companies may feel adequately protected against standard cyber threats, but many underestimate AI-powered cybercrime risks.
Read Post
trustcloud

Navigating third-party risk assessments in the digital era: A technology leader's perspective

Feb 18, 2025 By Tejas Ranade In TrustCloud
These days, businesses lean heavily on third-party vendors to boost efficiency and bring fresh ideas to the table. But with that reliance comes risk — from data breaches to compliance issues to disruptions that can ripple through your entire operation. That’s why it’s so important for technology leaders to put strong Third-Party Risk Assessments (TPRAs) in place.
Read Post
kovrr

Measuring the Effectiveness of Cyber Security GRC

Feb 17, 2025 By Kovrr In Kovrr
‍Cyber security governance, risk, and compliance (GRC) programs are often viewed as cumbersome - a necessary yet costly component of doing business, providing very little value to the organization in terms of strategic impact. This narrow perception, unfortunately, limits the plethora of opportunities that a robust cyber security GRC framework would otherwise unlock.
Read Post
riscosity

Delivering Effective Customer Notifications

Feb 14, 2025 By David Schlesinger In Riscosity
A few months ago I received a call from my Grandma. She was concerned about having received a notification that she had been part of a data breach and wasn’t sure what to do about it. She had many seemingly basic, but good questions; What’s PII? I use the app on my iPad, is it safe to log into other applications like my bank? Is it safe to use my account? How do I know when it’s safe?
Read Post
bitsight

OSINT Framework: How Open Source Intelligence Powers Cybersecurity

Feb 14, 2025 By Sabrina Pagnotta In BitSight
Open Source Intelligence (OSINT) is the backbone of modern cybersecurity investigations, helping analysts and law enforcement uncover threats, assess risks, and gather intelligence from publicly available sources. In this guide, we break down everything you need to know about OSINT, from key frameworks and tools to how it's used in cybersecurity.
Read Post
nucleus

Breaking the Swivel Chair Cycle: Why Security Teams Struggle with Asset Visibility-and How to Fix It

Feb 13, 2025 By Corey Tomlinson In Nucleus
For many security professionals, managing asset visibility feels like an endless game of whack-a-mole. They are stuck in what experts call the “swivel chair approach”—constantly pivoting between multiple dashboards, spreadsheets, and security tools to manually stitch together an understanding of their risk landscape.
Read Post
SecurityScorecard

Vendor Risk Assessment Template

Feb 13, 2025 By SecurityScorecard In SecurityScorecard
When you work with third parties, their risk is your risk. Common risks associated with vendors include everything from compliance risk to operational risk to financial and reputational loss. Vendor risk assessments can help your organization narrow down who to trust, and help you identify the level of risk you are taking on with your vendors.
Read Post
SecurityScorecard

The Ultimate Data Breach Response Plan

Feb 13, 2025 By SecurityScorecard In SecurityScorecard
In a hyper-connected world, security breaches continue to increase in size and scope. Cybersecurity threats come in various forms, from social engineering to database vulnerability exploitation. With that in mind, potential damages caused by these data breaches are more likely than ever, regardless of an organization’s size. To bolster your cybersecurity posture, you should put together a data breach response plan as a way to prepare your organization.
Read Post
riscosity

Securing Data Flows into Your Cloud Data Warehouse

Feb 12, 2025 By Jackson Harrower In Riscosity
Traditionally, data security focused on protecting data at rest within the confines of your on-premise data center. The cloud era has blurred these lines. Data now flows through complex pipelines, often traversing multiple services and third-party vendors. This expanded data perimeter creates new vulnerabilities: It’s crucial to ensure that the data loaded into warehouses and analytics tools is scanned for sensitive information and redacted or redirected accordingly.
Read Post
upguard

Securing Budget for TPRM: How to Convince Executives to Invest

Feb 12, 2025 By Leah Sadoian In UpGuard
Advocating for a larger budget is a common need for most security professionals. With so many business obligations fighting for priority and funding, even vital concerns like Vendor Risk Management can fall through the cracks. However, third-party cyber risks can devastate businesses in the blink of an eye—meaning maintaining a proper third-party risk management program should be at the top of your priority list.
Read Post
obrela

What is an SQL injection and how to prevent it?

Feb 12, 2025 By Obrela In Obrela
SQL Injection (SQL) also known as SQLI is a severe security vulnerability that allows attackers to interfere with the queries and applications made to its database. By inserting malicious SQL code into input fields, attackers can manipulate the database, leading to unauthorized data access, data corruption, or even complete system compromise. This attack technique is made possible because of improper coding of web applications.
Read Post
bitsight

7 Questions Tech Buyers Should Ask About How Their Vendors Use AI

Feb 12, 2025 By Anders Norremo In BitSight
As AI becomes an increasingly critical component in the digital supply chain, tech buyers are struggling to appropriately measure and manage their AI risk. Keeping tabs on emerging risk from the AI technology they use is hard enough. But often the most crucial AI business functions that organizations depend upon aren’t directly under their control or care, but instead are governed by the tech vendors that embed them into their underlying software.
Read Post
obrela

What is a man in the middle attack? Definition & examples

Feb 11, 2025 By Obrela In Obrela
A Man-in-the-Middle (MitM) attack occurs when a cybercriminal secretly intercepts and manipulates communications between two parties who believe they are interacting directly. It is currently one of the most deceptive and dangerous cyber threats. Such attacks often lead to data theft, unauthorized access and compromised privacy, to name a few consequences.
Read Post
cycognito

Security Risks in Internet-exposed SCADA in Manufacturing

Feb 10, 2025 By Rob Gurzeev In CyCognito
Industrial control systems (ICS) and SCADA (Supervisory Control and Data Acquisition) environments were never designed to be exposed to the internet. Yet, as manufacturing enterprises embrace digital transformation, they find themselves in a challenging position—balancing operational efficiency with cybersecurity risk.
Read Post
SecurityScorecard

A Deep Peek at DeepSeek

Feb 10, 2025 By SecurityScorecard In SecurityScorecard
DeepSeek’s rapid ascent in the AI space has made it impossible to ignore. Its sophisticated models and AI assistant have captured global attention. And, while headlines focus on DeepSeek’s capabilities, STRIKE research exposes critical security flaws, hidden data flows, and unanswered questions about who has access to the data and why.
Read Post
upguard

Using Exposed Ollama APIs to Find DeepSeek Models

Feb 7, 2025 By Greg Pollock In UpGuard
The explosion of AI has led to the creation of tools that make it more accessible, leading to more adoption and more numerous, less sophisticated users. As with cloud computing, that pattern of growth leads to misconfigurations and, ultimately, leaks. One vector for AI leakage is exposed Ollama APIs that allow access to running AI models. Those exposed APIs create potential information security problems for the models’ owners.
Read Post
riscosity

Ranking Regulatory Frameworks

Feb 6, 2025 By Anirban Banerjee In Riscosity
Region: European Union (Global impact for companies handling EU residents' data) Scope: Data privacy, security, and governance The GDPR sets the gold standard for data protection, demanding comprehensive compliance across a spectrum of activities. Organizations must ensure lawful data processing, gain explicit consent, enable data portability, and implement measures like data protection by design and default.
Read Post
nucleus

Who Owns Vulnerabilities?

Feb 6, 2025 By Tally Netzer In Nucleus
The question of ownership is one of the biggest reasons vulnerabilities persist in organizations far longer than they should. Who owns vulnerabilities? This isn’t just a theoretical debate—it’s a critical operational issue. Modern scanning solutions excel at identifying and prioritizing vulnerabilities, but without clear ownership, those vulnerabilities often linger unaddressed or improperly documented, increasing an organization’s risk exposure.
Read Post
kovrr

Communicating Cyber Risk at the Board Level: 7 Lessons for 2025

Feb 6, 2025 By Kovrr In Kovrr
‍As digital threats grow more sophisticated and cyber regulations expand in scope, business stakeholders are beginning to recognize the need to learn more about cybersecurity and how it impacts organizational performance. With this recognition comes the elevation of chief information security officers (CISOs) into the boardroom, tasked with explaining these cyber intricacies and offering strategies that can help safeguard operational resilience and drive long-term growth.
Read Post
cultureai

The AI Hunger Games - The Rapid Adoption of DeepSeek: A Security Nightmare

Feb 5, 2025 By Oliver Simonnet In CultureAI
The recent rapid adoption of the AI application “DeepSeek” has gained significant global attention. Becoming the app on both the Apple Store and Google Play Store within its first few days, seeing over 10 million downloads. While this explosive growth of DeepSeek R1 highlights the public’s fascination with AI-driven tools, the security community and policymakers have been less enthusiastic.
Read Post
bitsight

Types of Cyber Crimes and How to Protect Against Them

Feb 5, 2025 By Sabrina Pagnotta In BitSight
With increased reliance on the cloud and data being today’s digital currency, cybercrime has become a pervasive threat that impacts individuals, businesses, and governments alike. Understanding the various types of cybercrime is essential for developing effective strategies to protect against these malicious activities.
Read Post
riscosity

Strategies and Tradeoffs when Running AI Models on Lean Resources

Feb 5, 2025 By Anirban Banerjee In Riscosity
This article explores the recommended infrastructure for AI workloads, strategies to optimize performance on less expensive servers, and trade-offs in terms of cost and results. We’ll also provide examples of AWS EC2 instance types and pricing to illustrate practical options.
Read Post
bitsight

Bitsight TRACE Systematic Approach: CVE-2024-23897 as a Case Study

Feb 4, 2025 By Eduardo Silva In BitSight
This article provides details on how Bitsight TRACE addressed CVE-2024-23897, an arbitrary file read vulnerability that affects Jenkins, a well-known open-source automation server. It includes technical details, common pitfalls, and decisions made since the CVE disclosure until now. The investigation of CVE-2024-23897 is an example of how we can obtain the target instance version but not solely rely on it to classify an instance as vulnerable. First, we go deep to understand the vulnerability.
Read Post
lookout

Is Your Inbox a Cybersecurity Risk?

Feb 4, 2025 By Lookout In Lookout
In today’s flexible and fast-paced digital environment, email still remains the backbone of communication for many organizations. Employee email accounts are chock-full of sensitive information from intellectual property to customer data, which makes securing email servers crucial. Data leakage and unauthorized access not only disrupt operations and cost time and money to fix, but they can also damage an organization’s reputation.
Read Post
riscosity

What's new in Riscosity: January 2025

Feb 3, 2025 By Christopher Widstrom In Riscosity
Riscosity’s premier capability to automatically act upon any data type that organizations’ products are sharing with 3rd party vendors has been enhanced even further to support SFTP traffic. Now, any data type going over SFTP to any 3rd party vendor can be automatically blocked, redacted, or notified about.
Read Post
kovrr

Materially Missing the Mark With Cyber Event Disclosure Rules

Feb 3, 2025 By Kovrr In Kovrr
A little over a year ago, the US SEC’s rules on cybersecurity incident disclosures were enacted, mandating that all publicly traded companies report material cyber events within four days after they had been determined as such unless exempted for national security or safety reasons. The rationale behind these rulings was that they would provide investors and relevant stakeholders with the information necessary to make more informed decisions, thereby leading to more realistically priced options.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.