Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Smarter Security Assessments: Automate, Customize, Scale

May 30, 2025 By UpGuard In UpGuard
Discover how AI is transforming third-party risk management. In this update, Michelle from our Customer Success team walks through key improvements to AI-Assessments—from instant Security Profiles and smarter questionnaires to faster reporting and risk remediation. See what’s live, what’s coming next, and how your feedback is shaping the future of vendor risk. Interested in finding out more about UpGuard?
View Video
Trustwave

Regulations Rising, Risks Persisting: The Cybersecurity Crossroads Facing Australian Hospitality

May 30, 2025 By Craig Searle In Trustwave
The hospitality industry’s cybersecurity posture is approaching an inflection point. Businesses are increasingly having to balance cost pressures in a challenging economic environment, while balancing technological innovation with escalating threats. Australia’s regulatory reforms, including heightened penalties and critical infrastructure protections, provide a framework for resilience; yet enforcement gaps will remain.
Read Post
bluevoyant

BlueVoyant Recognized in Gartner's Market Guide for Third-Party Risk Management Technology Solutions

May 29, 2025 By Joel Molinoff In BlueVoyant
The recent publication of Gartner’s Market Guide For Third-Party Risk Management Technology Solutions (1) is especially timely as the percentage of cyber breaches involving third parties doubled over the past year to 30% according to Verizon’s 2025 Data Breach Investigations Report.
Read Post

New in Breach Risk: Threat Monitoring Powered by an AI Analyst #cybersecurity #tprm #ai #security

May 29, 2025 By UpGuard In UpGuard
Peter, Senior Product Marketing Manager at UpGuard, shares how our new Threat Monitoring feature helps security teams detect and triage real threats across the open, deep, and dark web—faster and with more clarity. Now in early access. Talk to your UpGuard rep to get started.
View Video
kroll

Known vs. Unknown Risks: The Role of the Enterprise Risk Retainer in Preparing for the Future

May 29, 2025 By Kroll In Kroll
Preparing for risk is critical to ensuring organizational resilience, but what about the risks that can’t be planned for? Businesses frequently fall into the trap of strategizing only for known risks—those that are easily anticipated—while failing to recognize their blind spots in relation to unknown risk events.
Read Post
upguard

SaaS Permissions: Are Employees Granting Too Much Access?

May 28, 2025 By Leah Sadoian In UpGuard
Today, the average employee juggles dozens of SaaS apps—each requesting access with a quick click. But how many employees check whether those permissions (granted in moments to boost productivity) might be unlocking sensitive company data? While businesses thrive on the agility and collaboration SaaS tools provide, this convenience can create a frequently overlooked web of user-granted permissions.
Read Post
astra

Risk Assessment: An Expert Guide

May 28, 2025 By Keshav Malik In Astra
Businesses are at risk of cyberattacks every day. Without careful scrutiny, these threats result in data loss, financial loss, and reputational damage. A comprehensive risk assessment enables the identification and mitigation of vulnerabilities in advance. This guide leads you through the process of performing a risk assessment, defining pain points with workable solutions, and provides you with security tools to improve your overall security posture.
Read Post
bitsight

What Is a Remote Access Trojan (RAT), and Why Should You Care?

May 28, 2025 By Emma Stevens In BitSight
According to our 2025 State of the Underground report—in which we take a look back at cybercrime on the deep and dark web from the past year—384 unique varieties of malware were sold in 2024, an increase from 349 in 2023. To determine this number, our research team examined malware and hacking tools for sale on the top three criminal forums, and as a result, we found that Remote Access Trojans (RATs) were the second most common form of malware in 2024, just behind stealer malware.
Read Post
Trustwave

Trustwave Named a Representative Vendor in 2025 Gartner Market Guide for Third-Party Risk Management Technology Solutions

May 28, 2025 By Trustwave In Trustwave
The industry analyst firm Gartner has named Trustwave a Representative Vendor in its latest publication, 2025 Gartner Market Guide for Third-Party Risk Management Technology Solutions. Trustwave believes the report is a guide for organizations considering third-party risk management (TPRM) technology solutions from vendors that will best suit their needs.
Read Post
nucleus

Application Security Vulnerability Management: Bridging AppSec and VM for Modern Risk Reduction

May 28, 2025 By Aaron Attarzadeh In Nucleus
Application security has evolved far beyond traditional vulnerability management (VM). Today, security teams face massive scale, increasing complexity, and a constant flow of vulnerability findings that often vanish in hybrid and cloud-native environments. We’ve moved from managing a single virtual machine to dealing with an unlimited number of containers and ECS tasks, many of which only exist for about 15 minutes.
Read Post
Featured Post
The Value of Threat Intelligence in Ensuring DORA Compliance

The Value of Threat Intelligence in Ensuring DORA Compliance

May 27, 2025 By Cyrille Badeau, Vice President International Sales In ThreatQuotient
"Expect the unexpected" is a saying that holds particular weight in cybersecurity. In 2025, with continuing technological advancement, the divide between game-changing business opportunities and serious cyber threats has never been starker. With innovation and disruption unlikely to slow the pace any time soon, all sectors must build their operational resiliency to stay ahead and ensure stability.
Read Post

Our AI is scanning the dark web to recover stolen credentials right now. #cybersecurity #ai #vendor

May 27, 2025 By UpGuard In UpGuard
Our AI is scanning the dark web right now — here’s what it’s finding. In this cybersecurity short, we give you a real-time glimpse into how AI-driven tools are monitoring the dark web for stolen credentials, emerging threats, and malicious activity before it reaches your business. From detecting leaked passwords to identifying early signs of cyberattacks, AI is transforming threat intelligence and external attack surface management (EASM).
View Video

From Compliance to Cyber Resilience: Leadership Lessons from the Frontline

May 26, 2025 By UpGuard In UpGuard
In this fireside chat, Randy Vickers, Deputy CISO at the National Student Clearinghouse, shares hard-earned lessons on securing sensitive data at scale, navigating vendor risk, and leading high-impact security programs—especially when budgets are tight and threats are evolving fast.
View Video

Staying Ahead of Evolving Cyber Threats: What Security Teams Need to Know

May 26, 2025 By UpGuard In UpGuard
Dan Bradbury, Chief Product Officer at UpGuard, kicks off our 20th Summit with a look at how far we’ve come—and where we’re headed. From AI-powered risk assessments to expanded threat intelligence, discover what’s new, what’s next, and how your feedback continues to shape our roadmap.
View Video
upguard

47% of Breaches Involve Vendors: Is Your TPRM Ready?

May 26, 2025 By Edward Kost In UpGuard
Organizations are still struggling to manage vendor-related cyber risk effectively. According to a recent study by Imprivata and the Ponemon Institute, nearly half of organizations fall victim to data breaches involving third-party network access. This isn't just another statistic. It's a critical cybersecurity issue hinting at broader limitations of traditional TPRM programs.
Read Post
kovrr

The Guide for Moving From Qualitative to Quantitative Risk Assessments

May 26, 2025 By Kovrr In Kovrr
‍Once relegated to the technical corners of the organization, cybersecurity is no longer an isolated business problem that can be attended to reactively. Amid the rising costs of cyber incidents and growing regulatory scrutiny, it has become a high-level business risk that requires proactive analysis.
Read Post
nucleus

May 2025 Release: Charting the Future of Risk Reduction with Nucleus

May 23, 2025 By Scott Kuffer In Nucleus
Vulnerability management is no longer about simply cataloging risks. It’s about reducing them intelligently, at scale, and in alignment with how your business operates. At Nucleus, we believe in building a platform that doesn’t just surface issues, but solves them. With our latest release, we’re doubling down on that vision.
Read Post
Power Your Delivery Efficiency with Advanced System Solutions

Power Your Delivery Efficiency with Advanced System Solutions

May 23, 2025 By SecuritySenses In SecuritySenses
Logistics is in perpetual motion, many times at a breakneck speed. From rising fuel prices and an enduring driver shortage to the insatiable customer demand for same-day, lightning-fast delivery, fleet, operations, and logistics managers are in a daily struggle to keep their wheels turning smoothly. The push toward more visibility and control of operations isn't a fad; it's a call to survival. But suppose you weren't just able to meet these challenges but actually overcome them, turning your delivery operations into a streamlined, high-performance powerhouse? That's where advanced system solutions enter the picture.
Read Post
bitsight

Lumma Stealer is Out... of business!

May 21, 2025 By Bitsight TRACE In BitSight
Since mid-2024, Bitsight has been collaborating with Microsoft’s Digital Crimes Unit and other partners to dismantle the operational capabilities of Lumma Stealer (LummaC2) — currently the most widely distributed information stealer. Early this week, a coordinated action was carried out to disrupt its operations and take down the supporting malware infrastructure.
Read Post
upguard

Detecting Generative AI Data Leaks from ComfyUI

May 21, 2025 By Greg Pollock In UpGuard
By now we’re all familiar with the capabilities of generative AI for creating images. For some tasks, like casting an existing image in a recognizable art style, it works well. Much more than that and it encounters limitations: complex prompts often don’t return exactly what you imagined and iterating on a failed prompt can quickly become time-consuming.
Read Post
upguard

Digital Brand Protection in the Age of Impersonation

May 21, 2025 By Leah Sadoian In UpGuard
Online fraud remains a significant and rapidly expanding threat in today's cyber threat landscape. According to the FTC, consumers in the U.S. lost a staggering $12.5 billion to fraud in 2024, a 25% surge from the previous year. The most commonly reported category? Imposter scams. This difficult-to-intercept form of fraud alone accounted for $2.95 billion of those losses.
Read Post
cyberint

External Exposure: Navigating Risk for the Multi-National Enterprise

May 15, 2025 By Adrianne Chester Camat, Ron Ofer, Anastasia Plotkin and Darja Feldman In Cyberint
The bigger your business, often the larger the size of the attack surface you need to secure. That’s why multi-national enterprises typically face a different set of cyber security priorities than SMBs. Here’s another, less often discussed factor that can complicate security and risk management: Whether your company is a multiple entity or a single entity.
Read Post
manageengine

Top tips: Managing the risks of BYOAI at work

May 15, 2025 By Shawn King Jason In ManageEngine
Top tips is a weekly column where we highlight what’s trending in the tech world today and list ways to explore these trends. This week, we’re discussing the rise of AI tools in the workplace—and the growing risks around their unregulated use. It started quietly. A few employees using ChatGPT to rewrite emails. A project manager testing Notion AI to summarize meetings. A developer relying on GitHub Copilot to speed up code. Now?
Read Post
bitsight

The First Domino: How Credential Theft Leads to Bigger Breaches

May 14, 2025 By Emma Stevens In BitSight
In 2024, we collected 2.9 billion unique sets of compromised credentials—a jump from the 2.2 billion collected in 2023. While this rise can be explained by advancement in Bitsight’s credential collection capabilities, we assess that the precise number of credentials shared on the underground has also risen, fueled by increased data breaches and the spike in stealer logs.
Read Post
kovrr

What Is a Data Breach and How to Mitigate Its Effects

May 14, 2025 By Kovrr In Kovrr
‍ ‍All data breaches are considered cyber attacks, but not all cyber attacks are breaches. A data breach is a unique type of cyber incident that specifically involves unauthorized access to sensitive and confidential information pertaining to customer data, corporate data, or both. DDoS attacks and business outages, for instance, are not categorized as breaches because an external actor has not compromised internal assets.
Read Post

Office Hours With Or Amir - Dive Into The First Ever CRQ-Powered Cyber Risk Register

May 14, 2025 By Kovrr - Cyber Risk Quantification In Kovrr
Explore Kovrr’s brand-new CRQ-Powered Cyber Risk Register — a first-of-its-kind solution that’s redefining the way organizations build cyber GRC programs and manage cyber risk. Led by Or Amir, Product Manager at Kovrr, this session will offer a hands-on deep dive into the risk register’s extensive capabilities and show you why moving beyond static, spreadsheet-based registers to a fully quantified, dynamic risk intelligence framework is necessary for achieving resilience in today’s landscape.
View Video
upguard

AI Just Rewrote the Rules of BEC: Are Your Defenses Ready?

May 14, 2025 By Leah Sadoian In UpGuard
Today, the average phishing email that lands in your CEO's inbox is flawless. It uses perfect grammar, contains an intimate understanding of your organization’s current business landscape, and ends with an urgent, contextually relevant request. This isn't the work of a typical cybercriminal; it's the hallmark of generative AI being weaponized, transforming social engineering from a numbers game into a targeted strike.
Read Post
Understanding Market Dynamics in Pre-IPO Investment Decisions

Understanding Market Dynamics in Pre-IPO Investment Decisions

May 14, 2025 By SecuritySenses In SecuritySenses
Looking to secure your stake at the start of the next major breakthrough? Investments in Pre-IPO companies can deliver significantly larger returns compared to traditional public market investments. The current investment environment has led to unprecedented numbers of retail investors attempting to purchase private company shares before they become publicly available. The appeal is obvious.
Read Post
sedara

Internal Cybersecurity Risks in Organizations

May 13, 2025 By Mohammed Hoque In Sedara
When most people think of cybersecurity threats, they picture outside attackers trying to breach the network. But often, the biggest risks are already inside. Whether it’s human error, shadow IT, or poor policy enforcement, internal vulnerabilities can be just as damaging. In this blog, we’ll explore five commonly overlooked cybersecurity risks within organizations and how you can proactively address them.
Read Post

Bridging ASPM and Vulnerability Management for Scalable Application Security

May 13, 2025 By Nucleus Security In Nucleus
In this webinar, "Bridging ASPM and RBVM for Scalable AppSec," security leaders from Cycode and Nucleus explore how to unify application and infrastructure vulnerability management in complex, cloud-native environments.
View Video
nucleus

RSAC 2025: The Turning Point for AI in Enterprise Security?

May 8, 2025 By Adam Dudley In Nucleus
RSA Conference 2025 in San Francisco was a breath of fresh air, literally and figuratively. The city felt more vibrant and welcoming, and the conference buzzed with genuine excitement. Unlike previous years, which were dominated by hype and theoretical discussions, this year’s focus was on tangible (not yet game-changing!) AI applications in cybersecurity. AI extended throughout the conference, from the keynotes through the track sessions and into the exhibition hall.
Read Post
SecurityScorecard

What Is a Supply Chain Attack?

May 8, 2025 By SecurityScorecard In SecurityScorecard
A supply chain attack does not start with your firewall. It starts with someone else’s. Instead of targeting your company directly, a cyber attacker looks for weak spots in your organization’s supply chain. That could be a trusted third-party vendor, a widely used software supplier, or even an outdated package from an open-source code repository. Once they find an opening, they exploit security vulnerabilities to gain access to your systems without ever going through the front door.
Read Post
SecurityScorecard

Safeguarding Against Subdomain Takeover

May 8, 2025 By SecurityScorecard In SecurityScorecard
Subdomain takeovers are a growing threat in today’s cloud-first ecosystem. As organizations rely on third-party services, continuously launch digital assets, and manage sprawling DNS configurations, they often leave behind vulnerable subdomains ripe for exploitation. In this article, we explore subdomain takeovers, why they pose such a serious risk, and most importantly, how to prevent them before threat actors strike.
Read Post
SecurityScorecard

Guide to Developing a Business Continuity Plan

May 8, 2025 By SecurityScorecard In SecurityScorecard
In today’s threat-heavy digital environment, having a Business Continuity Plan (BCP) isn’t just smart, it’s essential. Whether it’s a cyberattack, data breach, ransomware, or natural disaster, organizations need a strategy to mitigate risks, reduce downtime, and ensure continued operations. This guide walks you through how to develop a cyber-ready BCP that protects your organization from disruption and prepares you for the unexpected.
Read Post
bitsight

State of the Underground 2025: Key Trends Shaping Cyber Risk Today

May 7, 2025 By Dov Lerner In BitSight
We know that everyone loves a feel-good, optimistic story, and when we set out to write our annual State of the Underground report — an analysis of nearly 2 billion intelligence items that we collected in 2024, including posts from underground forums and markets, Telegram messages, and news articles — we hoped to find the cyber equivalent of a cup of hot chocolate.
Read Post
nucleus

Conquering the Chaos of Vulnerability and Exposure Management at RSAC Conference 2025

May 7, 2025 By Corey Tomlinson In Nucleus
Recently, industry analyst Jon Oltsik outlined a critical shift underway in cybersecurity: the move toward a threat-informed defense. As Oltsik describes, organizations are beginning to strengthen the intersection of vulnerability scanning and threat intelligence, using AI to bolster asset classification and risk scoring. This evolution is essential as enterprises seek to move beyond fragmented security practices and build a more cohesive exposure management strategy.
Read Post
upguard

Beyond the Red Flags: Responding to a Failed Vendor Audit

May 7, 2025 By Leah Sadoian In UpGuard
Picture this: your vendor’s latest security audit just landed in your inbox, and you spot multiple failure points. What’s your immediate action plan? Failed vendor audits are an uncomfortable but increasingly common reality as reliance on third-party vendors grows, and handling them poorly can lead to data breaches, costly compliance violations, and serious operational disruptions. Knowing how to respond effectively isn't just good practice—it's essential risk management.
Read Post
levelblue

Leveling Up GRC: From Fragmented Controls to Strategic Integration

May 6, 2025 By Danyel Loyd-Tate In LevelBlue
As the attack surface expands and organizations face pressure from evolving regulatory requirements, it becomes increasingly difficult to align compliance management with overall risk strategy. As a result, many organizations are managing compliance and risk separately, leading to redundancies, inefficiencies, and critical gaps that are overlooked or improperly managed.
Read Post
kovrr

The CEO, CFO, and Board's Expanding Role in Cyber Risk Management

May 6, 2025 By Kovrr In Kovrr
‍Cyber risks have steadily grown more disastrous over the years, with a single event having the power to cause billions of dollars worth of damage. As business leaders watch the monetary losses pile up, whether facing them firsthand or witnessing industry peers absorb the blow, they have begun to realize that they can no longer conceive of cybersecurity as a technical duty managed solely under the chief information security officer’s (CISO’s) purview.
Read Post
cultureai

Scattered Spider and DragonForce: A Case Study in Human-Centric Cyber Threats

May 6, 2025 By Oliver Simonnet In CultureAI
In April 2025, Marks & Spencer, the Co-op Group, and Harrods were all targeted by cyber-attacks that caused disruption across their services. Although attribution is still being confirmed, indicators strongly link these attacks to Scattered Spider, a group known for aggressive, human-centric tactics and high-profile breaches. This post is not an incident breakdown for each retailer.
Read Post
riscosity

How We Support Enterprise Adoption of MCP, A2A, and AI Integrations

May 5, 2025 By David Schlesinger In Riscosity
We’ve been hearing (and using) a lot of acronyms lately. MCP, A2A, ACP… it’s easy to fall behind. Fortunately for our customers, all of these new standards are API based! Since Riscosity is built to discover, monitor, and govern all HTTP-based data flows, it requires no extra integration or setup to handle MCP, A2A, or ACP traffic.
Read Post
astra

Complete Guide to Network Risk Assessment

May 2, 2025 By Keshav Malik In Astra
Network risk assessment is the cornerstone of any good cybersecurity strategy, not just another compliance checkbox. However, organizations that regularly and systematically assess the threat to their networks tend to be significantly more resilient to threats and intrusive actions and consistently show greater continuity of operations under attack.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.