Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security teams are familiar with the comforting sense of safety that comes from utilizing security controls like Single sign-on (SSO) providers to manage their organization’s major applications and critical tools. When these applications are routed through Okta, Azure AD, or other identity providers, your SaaS environment can seem managed and accounted for. But lurking underneath is a significant vulnerability: the SSO blind spot.

Ransomware activity continues to increase, and Bitsight data illustrates the scale of this growth. In our State of the Underground 2025 report, Bitsight TRACE observed a nearly 25% rise in unique ransomware victims publicly listed on leak sites. Additionally, the number of leak sites operated by ransomware groups grew by 53%.

Let’s get this out of the way: the term vulnerability management has always been misleading. It evokes the idea that we’re wrangling a tidy list of software flaws, checking boxes, patching holes, and keeping things humming. But anyone who’s worked in the trenches or tried to explain this chaos to an executive board knows the truth. What we call “vulnerability management” isn’t a single discipline, or even a well-contained function.

‍ ‍Risk managers have long used registers to keep track of and manage the threats their organizations face, and, as cyber risk emerged in the 21st century as one of the core market concerns, cybersecurity leaders, too, started to harness these tools to structure and prioritize their cyber-related exposure. However, while risk registers offer a starting point for this process, many have not evolved beyond their early design, remaining static qualitative inventories.

In today’s environment—marked by accelerating threats like ransomware, increasingly complex supply chains, and the growing footprint of AI and IoT—managing cyber risk has never been more urgent or more difficult. Our latest research with Sapio Research, The State of Cyber Risk and Exposure 2025, draws on the insights of 1,000 cybersecurity and cyber risk leaders around the world to understand what they are focused on today and what will be keeping them up tomorrow.

Cybersecurity leaders in the UK are facing a stark reality: managing cyber risk is becoming significantly harder. Not only are threats growing in scale and complexity, but a lack of visibility into digital exposures—both internal and across the supply chain—is compounding the challenge.

ToxicPanda is a banking trojan designed to infiltrate your mobile device, stealing financial details by targeting banking & financial apps. The malware keeps evolving, with the developers behind it being quick to add new features, such as overlaying pin & pattern codes, overlaying credential inputs for specific banking apps, allowing cybercriminals to remotely take control of compromised bank accounts and initiate unauthorized money transfers.

In this article The alarm wasn’t a breach. It was an invoice. A mid-sized enterprise onboarding a new analytics vendor found themselves tangled in a post-implementation scramble: customer data had been shared without encryption, the vendor’s security posture was based on trust alone, and legal had skipped the SLA review because “they’d worked with them before.” What followed wasn’t a data loss, but something quieter and more corrosive, an erosion of confidence.

For a AI software company like Riscosity, which helps organizations secure and govern data flows to third parties, compliance is not just a regulatory requirement—it is central to the value proposition. Recognizing this, Riscosity has launched a dedicated Trust Center at trust.riscosity.com, powered by industry leader Vanta, to streamline how it communicates its compliance posture with current and prospective customers.

Industry experts with over a decade of cybersecurity experience recognize that the old ways of doing risk assessment just don’t work anymore. You know what I mean? Those quarterly checklists and vulnerability scans that made us feel secure? They’re practically useless against today’s threats. Think about it. While you’re running your scheduled scan, attackers are already inside your network, mapping everything out.

Acreed, a new malware-as-a-service (MaaS) platform, appears to have taken the top spot in the infostealer ecosystem. We suspect this is due to the takedown of Lumma Stealer (LummaC2) in May 2025. In just its first week, Acreed was observed uploading over 4,000 stolen credential logs to a dark web Russian Market.

A serious new vulnerability (CVE-2025-53770, also known as “ToolShell”) is actively being exploited by cybercriminals to hack into on-premises Microsoft SharePoint Servers. The vulnerability, along with CVE-2025-53771 was discovered around July 18, 2025. Bitsight Research classifies CVE-2025-53770 as 10 out of 10 on our Dynamic Vulnerability Exploit (DVE) scale and CVE-2025-53771 as a 5.82 out of 10 indicating severe and moderate urgency respectively.

For decades now we’ve been locked in this game of cat-and-mouse where attackers develop a new technique and defenders catch up, or defenders introduce a new control and attackers adapt. From the evolution of network security to identity and access control, many of our technical controls have matured into strong and reliable defences. Yet as we continue to see in the media, attackers continue to get in, compromising even the most mature and secure of environments, in seemingly simple way.

Today, we’re excited to announce a preview of the Model Context Protocol (MCP) Server for Nucleus. This marks an important step towards AI-native workflows for vulnerability and exposure management. Model Context Protocol (MCP) is an emerging industry standard enabling seamless integration between enterprise applications and AI models. Backed by leading organizations like OpenAI, Microsoft, and Google, MCP servers are quickly becoming the foundation for AI-enablement across the enterprise.

In today’s digital landscape, where cyber threats grow more sophisticated and frequent, organizations must prioritize robust strategies to protect their critical assets—data, systems, and networks. Asset risk mitigation is a cornerstone of cybersecurity, involving the identification, assessment, and management of risks to these valuable resources. Two primary approaches dominate this field: proactive and reactive risk mitigation.

Organizations operating in sprawling, hybrid IT environments often lack complete visibility into all assets and their communication patterns. This gap creates blind spots where vulnerabilities go undetected, third-party components remain unpatched, and unauthorized lateral movement can occur without raising alarms.

Artificial intelligence—it’s a term you’ve likely encountered more than once today, and this won’t be the last. And while it reshapes how businesses operate, it’s also introducing new risks. As organizations embrace AI-powered tools for efficiency and innovation, it becomes essential to understand what technologies your vendors rely on, and what those choices mean for your cybersecurity posture.

Today, we're taking a big step toward making trust management even easier for our customers: Vanta has acquired Riskey, a company leading the way in real-time third-party risk monitoring. Their continuous vendor monitoring and alerting will soon be part of Vanta’s Vendor Risk Management product. ‍ Managing vendor risk is more important than ever.

In our first article exploring vulnerability management vs. exposure management, we explored the growing recognition that exposure management is not just a rebranding of vulnerability management. Rather, it’s a strategic evolution. Where traditional vulnerability management often focuses narrowly on CVEs and technical severity, exposure management demands a broader, more integrated understanding of risk across assets, environments, and attack vectors.

This report details an investigation into a Fast Flux network observed in 2024. It covers the technical details of the network, its observable infrastructure, the malware associated with it, and its presence on the dark web.

‍

‍ ‍ ‍Both the Marks & Spencer ransomware attack and the Qantas breach dominated headlines for weeks, each exposing serious lapses in how data and risk were managed at the organizational level. But within the cybersecurity community, the response took a different turn. Unlike with other commentary post-cyber incidents, the focus quickly moved away from compromised systems and toward something more structural. These weren’t framed as technical breakdowns.

Cyberattacks on supply chains in 2025 have become more frequent and severe, moving from isolated incidents to major multi-sector crises. These crises involve data theft in software patches, ransomware disrupting food, pharmaceutical, and financial pipelines. As attackers target vendors as entry points, defensive measures must adapt. This includes enhanced vendor vetting, code provenance controls, firmware security, and robust third-party risk response.

You are the CISO of a mid-sized enterprise that is experiencing rapid growth, i.e., your security stack is becoming increasingly complex by the month, compliance auditors are asking more challenging questions, and your board wants measurable proof that security investments are actually reducing risk. Meanwhile, attack vectors are evolving daily, and your current risk assessments consistently lag behind.

Aligning with the Australian Government’s expectations for cybersecurity can present challenges, especially for organizations unfamiliar with the frameworks in use. For those looking to work with or support government programs, understanding how systems are assessed against the Information Security Manual (ISM) is critical. The ISM, maintained by the Australian Signals Directorate (ASD), sets out cybersecurity principles to guide the protection of government information and systems.

Traditional asset inventories list what exists—they don’t reveal why an asset is critical or how it might be attacked. With threats constantly evolving, teams need context: Which assets hold sensitive data? Which are actively targeted? Without this, efforts like patching or monitoring are unfocused and inefficient. Context-driven asset profiling aligns defenses with real risk—saving time, money, and reputation.

Fraud is everywhere. From phishing emails to fake investment schemes, scams have become an unfortunate part of our digital lives. However, one type of fraud that strikes fear across the board, affecting both individuals and businesses, is card and payment fraud. Unlike other scams, this one hit directly where it hurts: your money.

Until a decade or so ago, it was sufficient for security teams to use firewalls, antivirus, and intrusion detection to secure their business network. Today’s application environments have expanded beyond traditional perimeters to include APIs, open-source software, third-party modules, and AI-generated code. This greatly increases the attack surface and need for application risk management that’s holistic and automated.

Almost a decade after its discovery, the critical remote code execution vulnerability known as CVE-2016-10033 continues to pose a significant threat to web applications worldwide. In this post, we explain why it's so dangerous and the essential steps to protect your systems from this critical exposure in 2025.

Security Operations Centre (SOC) teams have never had it easy - but today, the complexity of defending against cyber threats has taken on an entirely new dimension. You’ve secured endpoints, networks, and cloud infrastructure. But the biggest threats are at the human layer, where visibility is lacking and most breaches begin.

As organizations become increasingly reliant on third-party vendors and external partners, leaders must ensure that risk management practices are both robust and efficient. Automated third-party risk management (TPRM) offers a transformative opportunity to drive measurable returns on investment (ROI) while enhancing operational resilience.

A risk register is a structured document used to identify, track, and manage risks throughout a project or within an organization’s operations. It serves as a central repository for all known risks, helping teams stay aware of potential issues that could impact objectives. Each entry typically includes a risk description, the likelihood and impact of the risk, the person responsible, and planned mitigation or treatment actions.

SIM swapping is not a novel cyber threat; it has been a persistent issue for over a decade. This technique exploits vulnerabilities in mobile carrier procedures and identity verification protocols. Attackers employ social engineering tactics to deceive telecom providers into transferring a victim’s phone number to a SIM card under their control.

Recent escalations involving the U.S. and Iran highlight an important reality: geopolitical tensions frequently extend into cyberspace. Cyber threat actors affiliated with or sympathetic to Iran are intensifying their efforts, increasing risks not only for U.S.-based organizations but also for companies across allied nations, particularly those with diplomatic, military, or critical infrastructure ties. Reflecting this elevated threat landscape, the U.S.

The DIST Cyber Security Sectoral Analysis 2025 provides valuable insight and advice for navigating cybersecurity threats in the UK. It emphasises that the cybersecurity industry must innovate and adapt continually to address new and emerging technologies, along with wide range of complex cybersecurity threats. The latest sectoral analyses highlighted that cybersecurity is a booming and dynamic industry in the UK, and it thrives on innovation, regulatory evolution and strategic collaboration.

In the cybersecurity landscape, sensational headlines and alarming vulnerability disclosures are commonplace. Recent events have been a whirlwind, with claims of massive data breaches and widespread vulnerabilities affecting critical infrastructure. From the overstated impact of Next.js middleware vulnerabilities to the exaggerated reach of Nginx ingress issues, it's clear that the cybersecurity community needs a reality check.

Vulnerability management has hit a wall. Exposure management is how forward-looking teams break through it. According to Gartner, by 2026, organizations that adopt a continuous exposure management approach to guide security investments will be three times less likely to experience a breach. a more advanced and iterative approach to vulnerability management. Despite growing interest, confusion remains around what exposure management is and how it differs from vulnerability management.