Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

upguard

Ransomware Inc: Decoding the RaaS Business Model

Apr 30, 2025 By Leah Sadoian In UpGuard
When you hear the word “ransomware,” many people think of a lone hacker launching a complex cyberattack. However, ransomware attacks that paralyze businesses worldwide have evolved into the product of a highly organized, industrialized criminal ecosystem. Their secret weapon? Ransomware-as-a-Service, or RaaS.
Read Post
cultureai

Introducing The Human Threat Map: A Tool for Mapping and Defending the Human Perimeter

Apr 29, 2025 By Oliver Simonnet In CultureAI
The cyber security perimeter has evolved many times over the years, and we’re now at a point in time where it is shifted once again. We have reached an era where defence is no longer just about protecting our networks, endpoints, cloud systems or SaaS applications, but about protecting our people. Attackers now target employees directly, relying on their ability to exploit human behaviour to gain access, rather than technical vulnerabilities.
Read Post
obrela

Bridging the Cyber Gap: Why Collective Resilience Starts with Empowering SMEs

Apr 29, 2025 By Muhammed Mayet In Obrela
Raising the bar for cybersecurity can’t happen in silos. Resilience comes from shared knowledge, mutual support, and proactive partnerships — between public and private sectors, large enterprises and small businesses, academia and industry. In this respect, joining the SOC4SME program to offer free services is not just a gesture — we’re doing it because we believe cybersecurity is a shared responsibility.
Read Post
bitsight

5 Ways Cyber Threat Intelligence Boosts Cyber Risk Prioritization

Apr 29, 2025 By Chris Campbell In BitSight
As cyber risk leaders are called to balance the responsibility of managing risk in the face of both broader attack surfaces and increased regulatory and budgetary scrutiny, prioritization of work is everything. Cybersecurity resources are finite, while the vulnerabilities and threats just keep growing. The best way for modern security programs to keep up is by directing resources to the risks that matter most to their specific organizations.
Read Post
kovrr

Kovrr Launches Industry's First CRQ-Powered Cyber Risk Register

Apr 29, 2025 By Kovrr In Kovrr
Today, Kovrr, the leading global provider of on-demand cyber risk quantification (CRQ) solutions, announced the launch of its CRQ-powered cyber risk register, a first-of-its-kind SaaS-based tool designed to provide security and risk managers (SRMs) with quantified insights that enhance cyber governance, risk, and compliance (GRC) initiatives.
Read Post
riscosity

What's new in Riscosity: April 2025

Apr 28, 2025 By Christopher Widstrom In Riscosity
Here at Riscosity, our team is keenly aware of the ongoing rise of AI adoption that is taking the world by the storm. As a company whose mission is to help organizations gain control over their 3rd party data flows, it is only logical that our capabilities support AI as well. What better time than RSA to announce the latest AI-related innovation that Riscosity has released!
Read Post
kovrr

Modernizing Cyber Risk Registers: From Spreadsheets to SaaS Solutions

Apr 28, 2025 By Kovrr In Kovrr
‍In the early days of cyber risk management, during which the responsibilities of a security and risk manager (SRM) were relatively siloed and limited in scope, leveraging a spreadsheet to maintain a cybersecurity risk register was a practical and widely accepted solution. At that time, the volume and complexity of cyber risks were much more manageable than they are today, making spreadsheets a convenient way to catalog them, prioritize mitigation activities, and track progress.
Read Post
Setting the Standard for AI Compliance: Vanta introduces AI Security Assessment

Setting the Standard for AI Compliance: Vanta introduces AI Security Assessment

Apr 24, 2025 By Vanta In Vanta
New offering helps organizations easily evaluate vendor AI's risk. Vanta becomes first trust management platform to achieve ISO 42001. Debuting new AI achievements and resources at booth #2127 at RSA Conference April 28 - May 1.
Read Post
upguard

The Shadow AI Data Leak Problem No One's Talking About

Apr 23, 2025 By Leah Sadoian In UpGuard
Is your team's favorite new productivity tool also your biggest data leak waiting to happen? Generative AI (GenAI) assistants like ChatGPT, Microsoft Copilot, and Google Gemini have quickly moved from novelty to necessity in many workplaces. These tools use machine learning and advanced algorithms to help employees draft content, analyze data, and even write code faster than ever before.
Read Post
cyberint

Top 10 External Risk Management Software Solutions in 2025

Apr 21, 2025 By Gemma Goldstein In Cyberint
Your organization’s attack surface extends far beyond your direct control. Exposed cloud assets, vulnerable APIs, and the security posture of your third-party vendors all introduce significant risks. Understanding and managing this external exposure is paramount. Effective External Risk Management (ERM) provides the critical visibility and intelligence needed to proactively address these threats.
Read Post
riscosity

Understanding MCP: Security Implications

Apr 18, 2025 By Anirban Banerjee In Riscosity
MCP, short for Message Communication Protocol, refers to a category of protocols used for exchanging structured messages between systems or applications. It was developed primarily to meet the communication needs of early enterprise systems that required: MCP protocols are often seen in banking, insurance, healthcare, and telecom industries—sectors where many systems were developed before APIs became mainstream.
Read Post
bitsight

Sensitive Data: Examples & How to Protect It

Apr 18, 2025 By Brian Thomas In BitSight
As a security professional navigating the new challenges constantly cropping up in cybersecurity, it’s critical to understand the ways your organization’s data could be exposed. Safeguarding sensitive information is paramount for organizations across all industries. Whether it's personal data of customers and employees or proprietary business information, the consequences of data breaches can be severe, ranging from financial losses to reputational damage.
Read Post
The Hidden Risk in Your Cloud: And What to Do About It

The Hidden Risk in Your Cloud: And What to Do About It

Apr 18, 2025 By SecuritySenses In SecuritySenses
It's easy to assume everything in the cloud is sorted. Files get saved, apps sync across devices, permissions exist. And on paper, that sounds tidy enough. But in practice? Data goes wandering. A spreadsheet ends up in the wrong folder. A document shared with the wrong person stays shared. A test environment is spun up, used once, then forgotten. Nobody deletes it, of course. Nobody remembers it, either.
Read Post
obrela

The Critical Importance of Supply Chain Risk Management in Cybersecurity

Apr 17, 2025 By Notis Iliopoulos In Obrela
In the contemporary digital era, supply chains have transcended their traditional role as mere logistical networks. They have evolved into pivotal ecosystems that underpin the success of modern businesses. Nevertheless, as these intricate systems undergo digital transformation, they have become increasingly vulnerable to cyberattacks.
Read Post

How LivePerson automates vulnerability management to reduce risk

Apr 17, 2025 By Tines In Tines
For modern security teams, managing vulnerabilities efficiently is critical to reducing risk and maintaining a strong security posture. However, the sheer volume of vulnerabilities, complex IT environments, and resource constraints make traditional approaches unsustainable. Automating key aspects of vulnerability management not only speeds up remediation, but also ensures consistency and accuracy across the entire vulnerability lifecycle.
View Video
Tines

Automating your risk register using Tines Records

Apr 16, 2025 By Conor Dunne In Tines
A risk register is a GRC tool used by teams to identify, assess, and manage various risks within an organization. It acts as a centralized repository and looks at the impact and probability of a risk to prioritize its management. In cyber security, a risk register helps maintain compliance with various standards like the ISO 27001 Information Security Management System (ISMS), NIST SP800-30 Guide for Conducting Risk Assessments, or the new European NIS 2 directive.
Read Post
bitsight

Milestone Progress: Accelerated Rating Rescans

Apr 16, 2025 By Arzu Ozbek Akay In BitSight
Bitsight customers and their third-party partners are well on their way to gaining faster clarity on how their remediation efforts impact their Bitsight Security Ratings. In an effort to support organizations that use Bitsight to prioritize internal security work, we started a phased rollout of Dynamic Remediation, a new initiative that accelerates the rating refresh process and makes it more responsive to meaningful security remediations.
Read Post
cultureai

The Offensive Potential of Computer-Using Agents

Apr 16, 2025 By Oliver Simonnet In CultureAI
Autonomous AI agents - known as Computer-Using Agents (CUAs) - are no longer science fiction! These systems can browse websites, interact with applications, and carry out tasks on their own. While intended to increase productivity, they can already be repurposed by threat actors for malicious use.
Read Post
upguard

How AI is Changing The Way We Manage Cyber Exposure

Apr 15, 2025 By Leah Sadoian In UpGuard
Artificial intelligence isn’t just a buzzword in cybersecurity—it’s rapidly becoming the backbone of both offense and defense in the digital battlefield. From hyper-realistic deepfakes to machine learning-powered threat detection, AI is fundamentally changing how we manage cyber exposure.
Read Post
Email List Hygiene and Cybersecurity Risks

Email List Hygiene and Cybersecurity Risks

Apr 15, 2025 By SecuritySenses In SecuritySenses
Email is a tool that people and companies need. Conversely, poor email etiquette may put you in danger online from data leaks and phishing scams. Following cybersecurity best standards and keeping a clean email list helps to guard sensitive data. This paper covers the value of cyber hygiene in email contact, its benefits, and how technology, such as an email locating tool, could enhance security.
Read Post
upguard

Analyzing llama.cpp Servers for Prompt Leaks

Apr 11, 2025 By Greg Pollock In UpGuard
The proliferation of AI has rapidly introduced many new software technologies, each with its own potential misconfigurations that can compromise information security. Thus the mission of UpGuard Research: discover the vectors particular to a new technology and measure its cyber risk. This investigation looks at llama.cpp, an open-source framework for using large language models (LLMs).
Read Post
SecurityScorecard

CISOs: The Perfect SCORE With Your Board

Apr 11, 2025 By SecurityScorecard In SecurityScorecard
You’ve done the work—mapped the risks, built the roadmap, secured the right tools. But when it’s time to face the board, the conversation stalls. Not because you’re wrong. Because you’re speaking a different language. Boards don’t operate in threat models and tech stacks. They operate in risk, revenue, and accountability. And if you want their support, you need to meet them there.
Read Post
Strategies to Mitigate Risks in AI-Driven Medical Note Systems

Strategies to Mitigate Risks in AI-Driven Medical Note Systems

Apr 11, 2025 By SecuritySenses In SecuritySenses
AI isn't just changing how healthcare works-it's redefining how care is delivered. With medical note systems powered by AI, clinicians are finally getting a break from endless documentation. But with that freedom comes a new set of challenges: accuracy, data safety, and the delicate balance between tech and human judgment. If you're adopting or managing these tools, it's not just about innovation-it's about protecting what matters most. Read on to discover the key strategies every healthcare leader must know to implement AI documentation systems responsibly and effectively.
Read Post
upguard

Threat Monitoring for Superannuation Security

Apr 10, 2025 By Greg Pollock In UpGuard
On April 4, 2025, The Australian Financial Review reported on a set of credential abuse attacks targeting multiple Austrian superannuation funds. These attacks were not breaches of the infrastructure of those companies, but compromises of individual customer accounts via stolen credentials. How were those customer credentials stolen?
Read Post
upguard

Preparing for the Next Big Cyber Threat: Expert Recommendations

Apr 9, 2025 By Leah Sadoian In UpGuard
Staying ahead of the game is a top concern for security teams as the cyber threat landscape continues to evolve rapidly. Every year seems to bring new technological advances, which also introduce new cybersecurity trends and significant risks. As organizations face these challenges, it’s essential to build proactive defenses, not reactive responses. The next big cyber threat is already here—ready or not.
Read Post
upguard

Ongoing TPRM Success: Continuous Security Monitoring with AI

Apr 9, 2025 By Nicholas Sollitto In UpGuard
All security professionals know third-party risk management doesn’t stop after one risk assessment. What about the next vendor? Or the future risks the vendors you’ve already evaluated will inevitably endure? While completing even a single risk assessment can feel like an arduous journey when done manually, all successful TPRM programs continue long after assessment.
Read Post
syteca

Third-Party Security Risks: How to Mitigate Potential Cybersecurity Threats

Apr 9, 2025 By Syteca In Syteca
Cooperation is the key to success, and working with third parties helps your organization increase efficiency, offer better products and services, employ highly qualified experts, and cut costs. However, all these benefits come at the price of additional cybersecurity risks. Even minor flaws in your third-party vendor’s security and privacy routines may lead to serious cybersecurity breaches in your organization.
Read Post
bitsight

How Research Supports the 2025 Bitsight Rating Algorithm Update

Apr 9, 2025 By Abdullah Al Rashid In BitSight
In keeping with Bitsight's ongoing commitment to making its ratings more meaningful and more representative of an ever-changing Cybersecurity landscape, the Ratings Algorithm Update for 2025 is scheduled to go into preview on April 8, 2025. The highlight of RAU 2025 is the incorporation of the Web Application Security(WAS) risk vector into the Bitsight Security Ratings1, and the associated deprecation/removal of Web Application Headers(WAH) risk vector.
Read Post
splunk

Sequenced Event Templates via Risk-based Alerting

Apr 8, 2025 By Haylee Mills In Splunk
Sequenced event templates are pretty cool, but they were developed around the time that Risk-based Alerting (RBA) was developed in Splunk Enterprise Security. Additionally, they don’t have all the great context we can generate with the holistic picture provided by risk, so I want to provide guidance on how we would implement its equivalent in the RBA context as they are now deprecated in Splunk Enterprise Security 8.0. There are two approaches we can utilize that do slightly different things.
Read Post
tripwire

Information Security Risk Management (ISRM) Boosts Compliance by Undermining Configuration Drift

Apr 7, 2025 By Katrina Thompson In Tripwire
Compliance is a “ticket to entry” for businesses today, and information security risk management (ISRM) makes sure organizations hang on to their ticket. In this blog, we’ll review how ISRM helps organizations not only get compliant but stay compliant. And how Tripwire makes that process automatic.
Read Post
bitsight

Identifying Compromised Credentials with Identity Intelligence

Apr 3, 2025 By Dor Gosher In BitSight
Every day, stolen credentials are bought, sold, and exploited on the dark web, fueling account takeovers, data breaches, and financial fraud. Organizations must act fast to stop these threats before they escalate. Yet, traditional security tools struggle to detect compromised credentials before it’s too late. According to Bitsight’s upcoming State of the Underground 2025 report, leaked credentials surged by 24% and logs listed on underground markets rose by 13.2% in 2024 alone.
Read Post
nucleus

Supporting CTEM Scoping with Exposure Assessment Platforms

Apr 3, 2025 By Steve Carter In Nucleus
In our recent article on Continuous Threat Exposure Management (CTEM), we highlighted how exposure assessment platforms (EAPs) like Nucleus can support several critical phases of the CTEM framework. In that article, we intentionally separated the scoping step from the other technology-dependent CTEM stages. Scoping begins as a business- and process-driven exercise. However, doing scoping well and at scale relies more on having the right technology.
Read Post

Achieving Continuous Exposure Management in Cloud-Native Environments

Apr 3, 2025 By Nucleus Security In Nucleus
In this webinar, "Achieving Continuous Exposure Management in Cloud-Native Environments," Tally Netzer and Aaron Unterberger from Nucleus dive deep into how modern cloud architectures impact vulnerability and exposure management. You'll learn: Why traditional vulnerability management falls short in cloud-native, ephemeral environments. How fragmented visibility and unclear ownership disrupt effective security practices.
View Video
riscosity

What's new in Riscosity: March 2025

Apr 2, 2025 By Christopher Widstrom In Riscosity
Riscosity has made it even easier to prioritize issues where data types are being shared by your Applications with 3rd party vendors by adding Confidence Scores to those data types. Users can focus in on the issues with data types that Riscosity had the highest confidence in determining without worrying about false positives.
Read Post
upguard

Report Writing Solved: Generating Actionable Assessment Reports

Apr 2, 2025 By Nicholas Sollitto In UpGuard
If you’re a security analyst, you know the work never stops. Even after your team completes an extensive vendor risk assessment and remediation, you still need to write a report to share your findings with key stakeholders. And this work isn’t a walk in the park by any means. Writing a risk assessment report often requires hours (or even days) of summarizing information, repopulating graphs, and balancing technical details with clarity to cater to technical and non-technical stakeholders.
Read Post
upguard

Security Bottleneck? Here's How to Accelerate Vendor Approvals

Apr 2, 2025 By Leah Sadoian In UpGuard
Organizations today move fast, but slow vendor approvals can grind everything to a halt. As companies increasingly rely on third-party vendors, slow vendor approvals create a serious security bottleneck. This slowdown costs organizations valuable time and resources—and leaves them open to security risks. It’s important to cohesively review and approve vendors to manage third-party risk, but organizations should be aware of just how long those approvals take.
Read Post
obrela

Why managed security services are now a business imperative

Apr 2, 2025 By Obrela In Obrela
Many organizations are discovering that managing cybersecurity in-house is not only costly but also becoming increasingly ineffective and in some case extremely risky for the business. With cyberattacks growing in sophistication and scale all the time, traditional, in-house IT teams can struggle to keep pace with threats, compliance obligations and operational demands. This is where managed security services come in.
Read Post
bitsight

The European Supply Chain Battlefield: Cybersecurity, National Defense, and the NIS2 Directive

Apr 1, 2025 By Francisco Fonseca In BitSight
In an increasingly interconnected digital world, supply chain security has become a critical concern for European organizations, policymakers, and national defense agencies alike. With adversaries exploiting software dependencies, contractors, and managed service providers (MSPs), the cybersecurity risks embedded within supply chains have never been more significant.
Read Post
cultureai

Top 5 Cyber Threats CultureAI Detected in Q1 2025

Apr 1, 2025 By The CultureAI Team In CultureAI
Cyber security threats continue to evolve, but one factor remains consistent: human error is still the greatest risk to modern businesses worldwide. Employees make mistakes, bypass security measures, and fall victim to sophisticated social engineering attacks, leading to devastating data breaches. Despite extensive security awareness training, the reality is that investing more time and money in training isn’t solving the problem.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.