The Back Room Problem: Why Most Organisations Lack AI Data Visibility
AI Risk & Governance Sam Soares CRO 31 October 2025 5 min read Share.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Introducing Bitsight Command Center: The Next Step in Cyber Risk Intelligence
Today’s security teams face disconnected tools and scattered data, which makes managing cyber risk increasingly complex. With the rapid rise in ransomware, new CVEs, and a constant stream of emerging threats, it has become difficult to monitor not only an organization’s own security posture but also the security of its third- and fourth-party vendors.
Understanding CVSS 4.0 and the Future of Vulnerability Scoring
The Common Vulnerability Scoring System (CVSS) has been the industry’s go-to framework for assessing vulnerability severity for nearly two decades. It provides a standardized way to measure and communicate the technical impact of a vulnerability. As threat landscapes evolve and organizations mature in their vulnerability management practices, questions about its relevance and limitations persist. That even led to our co-founder, Scott Kuffer, writing a defense of the algorithm earlier this year.
CVSS 4.0 and its Evolving Role in Vulnerability Management
Adam Dudley, Nucleus VP of Strategy and Alliances, provides some background on the Common Vulnerability Scoring System (CVSS) version 4.0 in this Nucleus conversation. He discusses the improvements made in the new version, the evolving role of CVSS in vulnerability management, the limitations practitioners face, and the future of scoring systems in the context of emerging technologies like AI. The conversation emphasizes the importance of context and quality inputs in effectively utilizing CVSS for risk assessment.
Delivering Real-Time Feedback with Bitsight Groma: Dynamic Remediation Now Fully Live
In December 2024, we announced Dynamic Remediation, an initiative that accelerates the feedback of customers' remediation efforts. The goal was simple but ambitious: reduce the time between a remediation and seeing that improvement reflected in Bitsight Security Ratings. This initiative was built in response to direct customer input. You asked for faster validation of your remediation, more transparency, and credit when vulnerable assets were remediated or taken offline.
The Evolving Landscape of Cybersecurity: Why Risk Management Is More Important Than Ever
In today's interconnected business world, every organization relies on a network of partners - from software providers and payment processors to data storage and cloud services. While this interconnectedness drives innovation and efficiency, it also introduces serious cybersecurity risks. A single vulnerability in your vendor ecosystem can open the door to data breaches, ransomware attacks, and compliance failures.
The Do's & Don'ts of Writing Audit-Proof Risk Assessments
When an auditor walks through your door, they aren't looking for a list of vulnerabilities; they're looking for proof that your Third-Party Cyber Risk Management (TPCRM) program is consistent, defensible, and robust. Internal and external auditors evaluate the Vendor Risk Management process by testing evidence, but they do so with different goals.
Why Risk Assessments Fail Stakeholders: Bridging the Gap
You've been here before. The vendor risk assessment is complete, the report is generated, and it lands on a stakeholder's desk. And yet, this comprehensive, detailed document, which provides vital information on a vendor's security posture, goes nowhere. The handoff lands in limbo.
From Brazil with Love: New Tactics from Lampion
This post will describe a long-running spam campaign from a Brazilian group known for using the Lampion stealer. We’ll detail the latest updates on the infection chain and its components, share previously undescribed indicators, and cover key takeaways, including.
Beyond "Fast": Why Deep, Continuous Risk Analysis is the Only Way Forward
False positives from security scanners cost one enterprise over 200 developer hours in a single quarter. At a loaded cost of $150/hour, that’s $30,000 in wasted productivity. Frustrated, they disabled their scanners entirely. Multiplied across dozens of teams, this problem costs enterprise organizations millions, and it is not an isolated issue. This impossible trade-off between noise and risk is why organizations need a more intelligent approach to security.
How to Safely Trade Crypto with Leverage and Manage Risk
Crypto markets in 2025 are turbulent, with 5-10% daily swings driven by US-China tariffs and inflation fears. To trade crypto with leverage means amplifying returns using borrowed funds, turning a $1,000 stake into $10,000 exposure at 10x leverage. But losses magnify too, with 80% of retail traders losing money. Safe strategies are critical to avoid wipeouts. Copy trading can help, mirroring pros' moves to balance risk and reward. This article explores how to trade smartly and manage risks effectively.
From Regulation to Remediation: How AI IoT Risk Management Simplifies with Trust Scores
As the Internet of Things (IoT) continues to expand across industries, risk management has become one of the most pressing challenges for security and compliance leaders. The convergence of AI and IoT (ai iot) is accelerating this transformation, introducing new opportunities but also creating a more complex risk landscape that requires advanced approaches to risk management.
Downstream Data: Investigating AI Data Leaks in Flowise
Low-code workflow builders have flourished in the AI wave, providing the “shovels and picks” for non-technical users to make AI-powered apps. Flowise is one of those tools and, like others in its category, it has the potential to leak data when configured without user authentication. To understand the risk of misconfigured Flowise instances, we investigated over a hundred data exposures found in the wild.
Shadow IT: The Haunting Inside Your Network
According to Bitsight TRACE’s 2025 State of the Underground report, the most exposed devices tied to critical vulnerabilities were found in the United States, and the most affected sectors included Information (telecom, IT) and Professional, Scientific, and Technical Services (including security and software vendors).
Why Infostealer Malware Demands a New Defense Strategy
Modern breaches rarely begin with a brute-force attack on a firewall, they now start with a user login. Valid account credentials are now a top initial access vector, responsible for 30% of all intrusions. In this post, we address a common misconception surrounding the inforstealer malware that may be putting you at risk of a data breach.
Resilience After the Breach: 6 Cyber Incident Response Best Practices
In its 2025 State of the Underground report, Bitsight TRACE found that ransomware activity continued to escalate in 2024, with a 25% increase in unique victims listed on leak sites and a 53% increase in the number of ransomware group-operated leak sites. The report also observed a 43% increase in data breaches shared on underground forums, with nearly one in five victims based in the United States. These findings highlight a continued upward trend in cyberattack activity.
Priority Scanning: Get Faster Visibility into Exposures Across your Attack Surface
Security teams today face a widening visibility gap: while exposures appear daily, traditional scanning cycles take weeks to reflect them.
Overcoming Cybersecurity and Risk Management Challenges
Every time you leave your home, you take various risks, like being in a car accident or being struck down by a meteor. In some cases, like the meteor, the likelihood of the event is so low as to be nearly nonexistent. In others, like the car accident, the likelihood might be higher. Similarly, every technology that you connect to your networks creates a cybersecurity security risk. Any device or application that connects to the public internet can be an entry point for attackers.
The Rise of AI Abuse: A story of Criminal GPTs, DeepFakes, Data Breaches, AI Malware, and Agentic Sleeper Agents
In late 2022, AI exploded into the mainstream with OpenAI’s ChatGPT, starting an AI-fuelled shift in both everyday life and the cyber threat landscape. Just as quickly as everyday users rushed to adopt the technology, so did threat actors. From generating phishing pretexts to writing malware and crafting deepfakes, AI systems have become both a new tool and a new target.
10 Common Vulnerabilities Found During Software Audits - and How to Fix Them
A software audit is not a checklist but a thorough examination into the internal workings of your system that lurking vulnerabilities are usually hiding. Thousands of breaches every year are due to organizations not paying early attention to software audit vulnerabilities that might have been noticed and eliminated at an early stage. This article exposes the top ten vulnerabilities that are oftentimes encountered during software audits, why they occur, and offers some remediation measures that can be taken.
Data Overload in the AI Era: Why Aggregation and Prioritization Are Non-Negotiable
AI was supposed to make our lives easier. Vendors promised it would cut through complexity, detect threats faster, and lighten the load on already overworked security teams. But if you’ve been paying attention, you know the truth: AI has given us more noise than ever. Corey Brunkow from Horizon3.ai joined Nucleus co-founder and CPO, Scott Kuffer, to unpack this problem during a recent webinar. AI helps attackers move faster, but on the defensive side, it’s created a flood of data.
Critical Intelligence Alert: ED 26-01 - Action Required
On October 15, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive ED 26-01, ordering federal agencies to mitigate a significant security breach involving F5 BIG-IP products. F5 disclosed that nation-state threat actors maintained long-term unauthorized access to internal systems, exfiltrating: This breach represents a major risk to organizations running F5 devices, especially those with exposed management interfaces or unpatched systems.
Kovrr Launches AI Risk Governance Suite
Kovrr, a global leader in cyber and AI risk management, today announced the launch of its AI Security Risk Governance suite, a comprehensive solution developed to help enterprises at any phase of adoption harness the value of GenAI responsibly.
Security Starts Left of Boom: Pre-Event Strategies for Proactive Risk Reduction
For years, cybersecurity has lived under a grim banner: “It’s not a matter of if you’ll be breached, but when.” That phrase became the industry’s guiding principle. Relying on prevention alone was slowly written off as impossible. Instead, the dominant wisdom declared that organizations must accept compromise as inevitable and prepare to deal with attackers after they had already gained a foothold.
Total Cost of Ownership (TCO) for Cyber Risk Quantification
While the average costs of cyber events rise, so do cybersecurity budgets, albeit at an extremely minimal level. This fiscal reality, which will only become more pressing as organizations scale their cyber GRC programs according to the external risk landscape, has made it all the more critical for chief information security officers (CISOs) and other security and risk managers (SRMs) to be able to evaluate the ROI of the various solutions and initiatives they implement.
Can Trading Education for Active Futures Traders Help Secure Your Investments?
Here's something uncomfortable: most futures traders bleed money during their first twelve months. This isn't speculation; it's a brutal pattern that shows up in every market cycle without fail. What separates the survivors from the statistics? Usually, it's education. But here's the real question you're probably asking yourself: Does structured learning genuinely protect your capital, or is it just another line item draining your account? The answer lives somewhere in the gray zone.
A CISO's Guide to the Business Risks of AI Development Platforms
The tools designed to build your next product are now being used to build the perfect attack against it. Generative AI platforms can spin up a pixel-perfect replica of your brand's login page in minutes, launching high-fidelity phishing campaigns at a scale and speed that legacy security models cannot handle. This isn't an emerging threat; it's an industrialized phishing engine that’s already being weaponized against businesses.
Making Cyber Risk Intelligence Easier to Understand, Explain, and Act On
Helping customers understand rating changes has always been a core commitment at Bitsight. A rating shift can spark questions from executives, board members, or regulators, and security leaders must be ready to answer with clarity and confidence. That’s why we’ve introduced new updates to the Bitsight platform designed to make our cyber risk intelligence solutions more actionable.
AI Risk Visibility: The Foundation of Responsible AI Governance
General-purpose AI (GenAI) and other artificial intelligence (AI) systems are now completely embedded within business processes across the market. The once purely imagined technology is significantly influencing operations and reshaping the very processes under which high-level decisions are made.
Reaching Peak Understanding of IoT and ICS Risk
In a world where internet connectivity intersects with just about every facet of our physical world—from cameras and door locks to power grids and factory robots—cyber risk intelligence has moved well beyond just protecting the bits and bytes of logical IT ecosystems. Security and risk professionals also have to be on the lookout for and aware of improperly secured cyber physical devices, like IoT devices, which greatly expand the enterprise attack surface.
Get Ahead of Digital Impersonation with Brand Threat Intelligence
Trust isn’t just a nice-to-have. It’s the foundation your organization is built on, fueling everything from customer loyalty to stronger partnerships and confident employees. But today, trust must be built across more digital channels than ever: websites, social platforms, app stores, and much more.
A CISO's Guide to the DoW's New CSRMC Framework
The Department of War’s (DoW) new Cybersecurity Risk Management Construct (CSRMC) marks a watershed moment for cyber defense. This move confirms that static, checklist-based security is obsolete. To defend against modern threats, organizations must adopt the continuous and proactive posture management approach experts have been recommending for years.
The Engine Room: Powering Your Human Risk Management Strategy with Intelligent Tech
We’ve come a long way. We’ve deconstructed the problem, explored the complexity of humans, and laid out a strategic framework and a practical map—all of which can be explored in more detail in our Human Risk Management (HRM) whitepaper. Now for the final piece of the puzzle: the engine. A strategy this dynamic and personalised can't run on spreadsheets and manual effort alone. It needs to be powered by an intelligent, integrated platform.
Risk-Based Vulnerability Management is the Engine Behind Modern CTEM Programs
Traditional vulnerability management once centered on scanning, enumerating, and remediating … and then repeating the process. In contrast, today’s enterprise attack surfaces shift by the hour. Cloud assets spin up and down. Business units deploy new SaaS tools overnight. Adversaries weaponize proof-of-concept exploits in days, or sometimes hours. Static, reactive processes can’t keep up.
Mobile App Security Assessment: Identifying Risks Before Attackers Do
Misconfigurations in storage and encryption settings can put your mobile apps at risk, but so can social engineering attacks. Mobile devices are powerful productivity tools, enabling your staff to work from almost anywhere. They can also be security risks, sharing sensitive data outside of a tightly controlled office environment. If smartphones and tablets are integral to your organization’s day-to-day workflows, a mobile application security assessment should be part of your cybersecurity strategy.
9 AI risks that could impact your organization-and how to mitigate them
As AI becomes more user-friendly and performance-focused, organizations are increasingly adopting it into their systems to streamline elaborate workflows. However, the rapid pace of adoption means that teams often implement AI models before fully mapping the security and compliance implications that they bring. According to Vanta’s State of Trust Report, more than 50% of organizations view AI risks as a growing concern today.
CVE-2024-36401 - GeoServer - tailoring a public PoC to enable at-scale high-confidence detection
At Bitsight, one of the responsibilities of the Vulnerability Research team is to develop fingerprinting methods to not only identify exposed services, but also vulnerabilities in those services. When it comes to detecting vulnerabilities, there are increased challenges depending on the complexity of both the vulnerability and the vulnerable service.
GeoServer CVE-2024-36401: Tailoring a Public PoC to Enable High-Confidence Detection
At Bitsight, one of the responsibilities of the Vulnerability Research team is to develop fingerprinting methods to not only identify exposed services, but also vulnerabilities in those services. When it comes to detecting vulnerabilities, there are increased challenges depending on the complexity of both the vulnerability and the vulnerable service.
How Risk Scores Are Assigned to Threats: Understanding the Metrics That Drive Security Decisions
Here’s the reality: Most organizations are drowning in threat alerts, vulnerability reports, and security incidents. Security teams can’t tackle everything at once, yet the leadership keeps asking “What should we prioritize?” Without proper risk scoring, you’re essentially playing cybersecurity roulette with your business assets.
Threat-Informed TPRM: A New Standard for Supply Chain Security
Third-party attacks have emerged as one of the most critical threats in the modern cyber landscape. Adversaries increasingly exploit vulnerabilities within external vendors, suppliers, contractors, and service providers to gain indirect access to target organizations, often with severe consequences. These breaches can lead to significant data loss, operational disruption, regulatory penalties, and reputational damage.
AI Adoption Is Outpacing Governance: Conversations on Managing AI Risk
Executives everywhere are under pressure to deploy AI fast — but our recent roundtable on AI risk, hosted by TEISS, revealed a growing concern: AI adoption is outpacing governance, and organisations are taking on more risk than they realise. While most enterprises have mature technical controls, many are missing visibility into how AI is being used — and by whom.
Critical Vulnerability Alert: CVE-2025-61882 in Oracle E-Business Suite
A critical vulnerability (CVE-2025-61882) has been identified in Oracle E-Business Suite, specifically impacting the Concurrent Processing component through its BI Publisher Integration. This widely used enterprise resource planning platform is deployed across finance, HR, procurement, and other critical business functions, making any compromise potentially devastating.
Strengthen GRC with cybersecurity: Safeguard against emerging threats
Organizations are faced with an increasingly complex and rapidly evolving threat environment. Cybersecurity plays a vital role in governance, risk management, and compliance (GRC), serving as a critical safeguard against emerging threats. As organizations integrate robust cybersecurity measures within their GRC frameworks, they are better positioned to protect their data, maintain operational integrity, and ensure compliance with regulatory requirements.
Temporary Phone Numbers: Privacy Tool or Security Risk?
Temporary phone numbers-often called disposable, burner, or virtual numbers-have become a common workaround for online verification. On the surface, they promise convenience and anonymity: sign up for a service without exposing your real number, avoid spam, test an app risk-free. But beneath that simplicity lies a dual reality: these tools can protect your privacy just as easily as they can enable fraud.
6 Ways to Make Your Risk Assessments Land With Stakeholders
As businesses expand, so do their lists of third-party vendors—and with them, the number of risk factors and complexity. This increase means that security analysts are often overwhelmed by a growing number of vendor risk assessments. However, completing an assessment alone isn’t enough; its value depends on how effectively the results are communicated.
Salesforce Extortion Accelerates With New Leak Site
For months now, journalists and cybersecurity experts, including UpGuard, have been following the movements of the hacker collective “Scattered Lapsus$ Hunters,” a sort of supergroup of the already well-known cybercriminal entities ShinyHunters, Scattered Spider and Lapsus$. Now, this collective has launched a website where they can extort payment from entities in return for delisting and deleting their data.
The Future of Human Risk Management is KnowBe4
KnowBe4 is the most advanced human risk management platform. Our platform measures human risk in real time. monitors behavior to avert disaster, and mitigates with actual intelligence. It's your complete human security platform. Leveraging the data of 13 million users and 70 thousand to protect your organization.
Unlock organizational success: Proven change management policies for GRC in 2025
Organizations across the globe are witnessing an unprecedented pace of transformation. In the ever-evolving landscape of governance, risk management, and compliance (GRC), staying ahead of change is more critical than ever. Successful companies are embracing dynamic change management policies to integrate GRC seamlessly into their strategic operations. The landscape of GRC is evolving.
Elevate Application Security from the Start with Static Analysis for Effective Risk Management
Securing your applications couldn’t be more important in today’s fast-moving world of software development. Organizations face mounting pressure to deliver innovative software at an accelerated pace, yet this speed must never compromise security. This is where DevSecOps becomes crucial. With threats constantly getting smarter, developers need effective tools to write secure code right from the start.
How a Digital Bank Reduced Shadow AI Risk by 80% - Without Blocking Innovation
When a fast-scaling digital bank began seeing widespread employee adoption of generative AI tools like ChatGPT and Gemini, their security team faced a growing dilemma: how do you protect sensitive data without shutting down innovation?
Empowering Safe GenAI Adoption at a 3,600-Employee Fintech - And Stopping 20+ Data Leaks a Day
Despite having modern DLP and CASB tools in place, they lacked the behavioural insights and real-time context needed to guide employee use of GenAI tools. Shadow AI use was growing, and SecOps lacked clear visibility into which incidents required intervention.
10 Intelligence-Focused Questions That Strengthen GRC-SOC Collaboration
The Governance, Risk, and Compliance (GRC) team and the Security Operations Center (SOC) shouldn’t be working in silos. Yet in many organizations, these teams operate with different data, priorities, and goals, missing a critical opportunity to strengthen the organization’s overall resilience. When GRC and SOC collaborate, the organization is better prepared, whether it’s responding to a real-world attack, passing an audit, or navigating the daily chaos of the cyber threat landscape.
A guide to understanding the UK Cyber Security and Resilience Bill
The UK government is strengthening its cybersecurity legislation with the Cyber Security and Resilience Bill (CSRB), an update to the 2018 Network and Information Systems Regulations. Modelled on the EU’s NIS2 Directive, the new Bill significantly expands cyber risk obligations across the UK’s digital ecosystem, targeting gaps exposed by recent high-profile breaches.