Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Bridging the Gap Between IT and OT Cybersecurity in the Middle East's Critical Infrastructure

As the Middle East rapidly accelerates its digital transformation across sectors like energy, oil and gas, and manufacturing, the traditional gap between IT and OT cyber security is closing. Industrial operators now rely on interconnected systems to maximize efficiency, but this increasing convergence introduces new vulnerabilities that cannot be addressed in isolation.

It's Time to Understand and Manage Vulnerability Debt

Vulnerability prioritization isn’t just an important piece of any organization’s vulnerability management process. It’s a requirement. With the volume so high, and growing, it’s simply impossible to address every vulnerability an organization encounters. Prioritization comes at a price. Many organizations focus on a small number of the most critical vulnerabilities in their environment, which leads to an important question: What happens to the rest?

Did you know that 75% of all data breaches involve a human element?

Every year, security budgets overlook the single biggest risk every organization faces: people. Technology and policies can’t stop a single bad click, but our new User Risk product gives security teams the visibility necessary to neutralize harmful activity before attackers can act. Purpose-built for today’s AI-driven threat landscape, User Risk finally gives teams a way to close the human gap in cybersecurity.

How AI Contract Solutions Reduce Risk and Cost

With how businesses operate nowadays, managing contracts is a vital aspect of company operations. Minor errors can cost you a lot of money and land you in legal trouble. Artificial intelligence provides a unique approach to enhancing contract management, reducing risk exposure, and reducing compliance costs.

Fireside Chat | Adapting Security Leadership for the Age of AI

Erika Carrara, VP & Chief Information Security & Infrastructure Officer at The Greenbrier Companies, shares how she’s adapting her security strategy to meet the demands of the AI era by modernising her tech stack, implementing AI governance, and embedding security into business culture. Interested in finding out more about UpGuard?

The Next Era of Cybersecurity Requires a New Approach...And a New Look

Cybersecurity teams have long faced an unfair fight against sophisticated digital threats with outdated TPRM, HRM, and ASM tools. It's time to change that. Our new logo and brand identity mark more than a refresh. They signal the next evolution of UpGuard. Every pixel reflects our vision for clarity in a complex world. And with the launch of the first cyber risk posture management platform, we're bringing that vision to life.

9 Best GRC Platforms for 2025

If there's one thing 2025 has made clear, it's that Governance, Risk, and Compliance (GRC) is no longer just a regulatory checkbox. It's the nervous system that connects security, operations, and strategy. Whether it's adapting to new laws, keeping an eye on third-party risks, or managing cyber threats before they become headlines, the right GRC platform can make all the difference. The list below focuses on the GRC solutions that are making the biggest impact right now.

From issues to impact: Making sense of GRC gaps

Every audit turns up a few surprises. A missing patch here. A policy that was missing a few key processes. An employee training record that slipped through the cracks. Together all of these gaps tell a story: somewhere, a control isn’t doing what you expect. ‍ In GRC, we give those events names, issues, risks, and exceptions, and the way they connect is what separates a reactive program from a resilient one. ‍

The Business of Malware: Inside the MaaS Economy

In our 2025 State of the Underground report, we found that 384 unique varieties of malware were sold across the top three criminal forums in 2024, a 10% increase from 349 in 2023, signifying an expansion in the underground malware marketplace. These figures reflect malware explicitly offered for sale (not shared freely), and each distinct version or naming variation is counted independently.

AI Agents Complicate GRC

The challenge isn’t just that AI agents are new. It’s that they blur traditional boundaries of data control, creating hidden sub-processors and uncontrolled data flows. For CISOs, compliance officers, and security leaders, this presents a fundamental governance problem: if you don’t know which AI services are touching your data, you cannot prove compliance.

Black Hat 2025 - From Chaos to Control - How Bank Of Hope Achieved Zero Critical Vulnerabilities

At Black Hat 2025, Nucleus Security and Bank of Hope shared how a small but determined security team transformed its vulnerability management program into a risk-driven, automated operation.

Attaxion Releases Agentless Traffic Monitoring for Immediate Risk Prioritization

Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to and from their digital assets - all without the need to deploy any agents or sensors on these assets.

AI and Fraud Detection: How Bank Reconciliation Tools Protect Your Cash

Fraud has always been a concern in business, but the digital economy has amplified both the scale and sophistication of fraudulent activities. From false vendor payments to suspicious cash transfers, threats are no longer isolated incidents; they're systemic risks that can affect an organization's cash flow. At the same time, finance teams are under immense pressure to deliver timely, accurate reporting while ensuring compliance, where manual processes, spreadsheet errors, and delayed reconciliations leave organizations vulnerable to undetected fraud.

How Cybersecurity Professionals Can Leverage App Reviews for Risk Insights

Cybersecurity analysts often narrow their attention to system logs, performance alerts, and other system logs. Even though these sources are essential, they are not the only sources that need attention. Feedback left by users, particularly on app stores, tends to go unnoticed. This is because the app stores are not only tools to distribute applications; they are invaluable stores of behavioral and experiential intelligence. For security professionals, App Reviews and Ratings can serve as an advanced warning system that highlights possible risks, unwanted activity, or security issues long before technical tools can uncover them.

State of third-party risk management: Expert insights and the path forward

In today’s fast-moving digital economy, growth depends on strong, trusted relationships with vendors, suppliers, and partners. These third parties are often essential to modern business operations; however, they also open the door to a range of risks, from regulatory fines to operational slowdowns. Many organizations have already felt the impact of these risks becoming reality firsthand.

Link11 Highlights Growing Cybersecurity Risks and Introduces Integrated WAAP Platform

Link11, a Germany-based global IT security provider, has released insights into the evolving cybersecurity threat landscape and announced the capabilities of its Web Application and API Protection (WAAP) platform, designed to provide multi-layered defenses against modern digital threats.

The ABCs of "ishing": From Phishing to Quishing

It’s no secret that in cybersecurity, many attacks begin with some form of “‑ishing.” But what exactly are these tactics and who’s behind them? From classic phishing emails to more advanced impersonation schemes using AI and social platforms, attackers continue to evolve their methods to exploit human behavior. Understanding the full spectrum of “‑ishing” techniques is critical for organizations looking to protect their people, data, and reputation.

Turning Compliance into a Competitive Advantage in the Middle East's Evolving Cybersecurity Landscape

Across the Middle East, governments are rapidly introducing new cybersecurity frameworks and regulations in response to the need to protect critical national infrastructure and digital economies. In the UAE, Saudi Arabia, and Qatar, for example, this is reshaping how organizations approach compliance and forcing security leaders to rethink their priorities.

Exposure Prioritization: Making Smart Decisions with Risk and Business Context

When vulnerability scans return thousands or even millions of findings, leading to an avalanche of tickets to evaluate, the real challenge begins: figuring out what to fix first. Exposure prioritization is the critical next phase of a mature exposure management program. After defining what exposure management is and establishing a normalized foundation of aggregated data, the question becomes: how do we cut through the noise and focus on what truly matters?

COPPA Compliance - Now!

On June 23, 2025, the Federal Trade Commission’s sweeping amendments to the Children’s Online Privacy Protection Rule (COPPA) took effect, ushering in more stringent duties for any operator collecting or using children’s data—whether via websites, services, or AI‑powered agents. Companies must achieve full compliance by April 22, 2026 (Finnegan | Leading IP+ Law Firm, Bass, Berry & Sims PLC).

The Role of AI Custom Solutions in Modern Financial Services

AI has been hard at work redefining the limits of what can be done in almost every industry, but in finance, the stakes and the payoff are especially high. Algorithms are used to make decisions that used to be made by experienced analysts, such as in fraud detection and portfolio optimization. However, the distinction between merely applying AI and actually taking advantage of it is sometimes as simple as a single factor - customization.

Supply Chains Under Siege: Inside the Cyber Threats on Manufacturing

In its 2025 State of the Underground report, Bitsight TRACE identified the manufacturing sector as the most targeted industry for the third consecutive year, accounting for 22% of the 4,853 cyberattacks where sector attribution was possible. Manufacturing is the backbone of global supply chains, and when a cyberattack halts operations, even just briefly, the ripple effects can be enormous. Production delays, missed shipments, and service disruptions quickly cascade across industries.

How Banks and Financial Institutions Can Effectively Manage Third-Party Vendor Risks

While financial institutions enjoy many benefits from cooperating with third-party service providers, this cooperation also raises significant concerns regarding the security of the data and resources these vendors have access to. In this article, we discuss why financial institutions hire independent contractors and what cybersecurity risks this cooperation entails. We also explore how building a third-party vendor risk management program can help you mitigate these risks.

Introducing the Riscosity AI Firewall

AI is moving through enterprises faster than security teams can track. Over the past year, AI privacy incidents have risen 56%, and most of those stem from tools security never knew were in use. 84% of SaaS tools are purchased outside IT, and 62% of CISOs say fewer than a quarter of AI tools in use have been approved through procurement. That means sensitive, regulated, or confidential data is often flowing to AI services invisibly, sometimes across borders, without governance or guardrails.

Enterprise-Grade Automation, Communication, and Risk: Nucleus Q2 Updates

This release raises the bar for enterprise-grade vulnerability and exposure management. We’re delivering on the promise of smarter, faster risk reduction powered by automation, enriched data, and operational depth. From fix-level SLA tracking to scalable API workflows and stakeholder-ready reporting, every enhancement is designed to help teams do more with less, and prove it. Here’s a breakdown of some of the major product updates from Q2 2025.

Defending Digital Trust: Fighting Brand Impersonation in the Wild

Just do it. Think different. The happiest place on earth. Nike, Apple, Disney are three iconic brands that have forever cemented themselves in our consciousness. How did they get there? A catchy slogan? A flashy logo? Sure, while slogans and logos change over time, they still make an impact. But what truly secures a brand’s reputation is trust. And trust is built over years, even decades, through consistency, authenticity, and relentless effort.

Third-party risk: Behind the Google, Chanel, & Air France-KLM breaches

2025 has been a summer of high-profile breaches. This post will focus on four notable and high-profile victims: Chanel, Google, Air France, and KLM. Although the companies and exact data sets differ, these breaches share a clear pattern: attackers compromised third-party CRM / customer-service platforms as part of a wider Salesforce-focused vishing/social-engineering campaign. From there, they exfiltrated customer-care records such as contact details, loyalty IDs, and customer-service email content.

Pixels, Polygons, and Payloads:Malware delivery in 3D software pipelines

This research explores an unconventional malware delivery vector, demonstrating how trusted creative software tools can be repurposed to deliver payloads in ways that bypass common defences, user expectations, and AI-based analysis. The work concludes with the creation of a successful Proof-of-Concept (PoC) for code execution and AV/EDR evasion using the open-source 3D software suite Blender.

Kovrr's Reports Hub: Grouping CRQ Metrics for Effective Communication

‍Cyber risk quantification (CRQ) is the process of translating cyber intelligence, both organization-specific and external, into measurable business terms. Typical high-level outputs include Average Annual Loss (AAL), or a business's expected financial loss from cyber events, and the Annual Events Likelihood. With CRQ, cyber governance, risk, and compliance (GRC) leaders can also drill down into more granular metrics for additional, scenario-specific context.

Mission Control for Modern Risk

Financial institutions face a harsh reality. As cyberattacks have become more sophisticated and move with greater velocity, a single incident can ripple across IT systems, payment networks, and customer accounts long before the organization can respond. The problem? Most security, fraud, IT operations, and risk teams still operate in silos. Each team monitors their own consoles, works from its own data, and follows its own playbooks.

You Can't Automate What You Don't Understand: Why Context Is the Missing Link in Exposure Management

In our recent webinar featuring Enterprise Strategy Group Principal Analyst, Tyler Shields, we discussed the widening gap between vulnerabilities organizations know about and what they can realistically fix. Most teams are swamped. Too much data, too many tools, and not enough people. Naturally, automation and AI come up as potential solutions. One comment from Tyler has stuck with me since watching and subsequently reviewing the webinar recording.

The Need for Proactive GRC (Governance, Risk, Compliance)

Today, businesses must rethink GRC (Governance, Risk, and Compliance) to stay ahead of the game. With a proactive approach, GRC isn’t a cost center; it’s a strategy to streamline innovation at scale. We’ll discuss how to build your foundation for GRC with a proactive stance, helping you grow and protect your business.

AI Is Not the Destination-It's the Catalyst: Inside Bitsight's Vision for Third-Party Risk Management

A new era in third-party cyber risk and exposure management is underway, one that operates in real time, informed by intelligence and scaled by automation. This shift wasn’t feasible even a few years ago. The scale, speed, and complexity of today’s threat landscape—spanning thousands of vendors, assets, and attack vectors—demand more than human capacity can manage. Artificial Intelligence is the catalyst making this new model possible.

What's new in Riscosity: August 2025

Here at Riscosity, we believe in making our users’ lives as easy as possible when using our product. Whether users are running scans, triaging results, or viewing reports, the workflows must be intuitive and a seamless part of users’ own environments. To that end, we have finished rounding out our comprehensive support for ticketing system integrations by adding Asana and Linear into the fold.

Evolving Security Frameworks: From Compliance Checklists to Intelligence Engines

For years, security frameworks have served as essential tools for aligning cybersecurity practices, but they’ve also come with limitations. Designed primarily for compliance, many frameworks are rigid by nature, sometimes to the extent of being a checklist, making them ill-suited for today’s dynamic risk environments. But the threat landscape has evolved, and so too must our approach.

Akira Ransomware Exploits SonicWall SMA100 Vulnerabilities: What You Need to Know

A newly surfaced set of vulnerabilities in the SonicWall SMA100 series appliances has captured the attention of cybersecurity professionals. While SonicWall has released patches for CVE-2025-40596 through CVE-2025-40599, and media reports point to a surge in Akira ransomware attacks targeting SonicWall SSL VPN infrastructure, CISA has not formally confirmed exploitation of these specific vulnerabilities by Akira at this time.

Announcing Secure Data Exchange for Agentic AI

PwC recently did an AI agent survey where they found the following: This all sounds great, right? For many reasons it is, but agentic AI creates a challenge of visibility for organizations into how AI agents are communicating with each other and external third-party vendors. Imagine a multitude of AI agents autonomously exchanging data across a complex mesh of third-party vendors and applications.

Kovrr's CRQ Dashboard Upgrade Unifies the Full Picture of Cyber Risk

‍ ‍With the continuously expanding influence that cybersecurity has in determining an organization's financial and operational resilience, cyber risk quantification (CRQ) has steadily become a foundational component of any robust cyber governance, risk, and compliance (GRC) program.

Framework Intelligence

Tired of spending hours reviewing vendor artifacts, policies, and questionnaires? Meet Bitsight Framework Intelligence—the AI-powered engine that transforms static compliance documents into structured, actionable insights. This capability, embedded in Bitsight’s Continuous Monitoring product, automatically parses vendor documentation, maps control evidence to frameworks like SIG Lite, NIST CSF, and ISO 27001, and generates audit-ready reports in just a few clicks.

What Should You Know About Digital Risk Management Before Investing in Crypto?

Investing in cryptocurrency comes with exciting opportunities, but it also introduces potential risks. Understanding digital risk management is essential to safeguard your assets and make informed, secure investment decisions.

Top 7 Tools to Manage Cybersecurity Risks from AI-Generated Code and Software

Managing AIcoded ("vibe code") software vulnerabilities doesn't require a full rebuild of your security program. By combining runtime visibility with targeted guardrails, teams can close blind spots in days instead of months. Spektion makes that possible as the leading runtimefirst solution for securing and managing vulnerabilities in from AIgenerated code in live apps, delivering live behavioral insight the moment code executes.

The 3 capabilities you need for a complete GRC strategy

Governance, risk, and compliance (GRC) is the foundation of a secure and accountable IT infrastructure. It refers to the practices that ensure your organization stays secure, meets regulatory requirements, and minimizes operational risks. For organizations running on Active Directory, the stakes are even higher. One misconfigured permission, one overlooked stale account, or one unchecked access path can open the door to breaches, privilege escalation, or audit failures.