Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Modernizing Vendor Risk for the AI Era

See how Riverside County transformed vendor risk from a manual, time-consuming process into a streamlined, data-driven operation that speeds decision-making, reduces risk, and enables innovation. Also hear about their approach to managing emerging AI risks, with practical, actionable lessons other security teams can apply. Interested in finding out more about UpGuard?

How Machine Learning Transforms Security Alert Chaos into Actionable Intelligence

Learn how GitGuardian’s ML-powered risk scoring turns 10,000 noisy secrets alerts into a prioritized, actionable queue, tripling analyst efficiency, boosting critical detection 5× over rule-based systems, and safely auto-closing over a third of low-risk incidents.

Why is Cyber resilience critical in the maritime industry more than ever

From navigating hostile weather to safeguarding crew and cargo, resilience is embedded into every operational decision in the maritime industry. Today, however, a new and less visible threat is reshaping what resilience means at sea: cyber risk. Digital transformation is providing great value through satellite navigation, automation, real-time fleet management and integrated logistics. But this connectivity has also expanded the attack surface.

Survey: Continuous Monitoring Emerges as Top Priority for Security Leaders in Germany

German cybersecurity teams are making meaningful progress in exposure management, but critical gaps remain that limit their ability to reduce business risk. That’s one of the key takeaways from Bitsight’s State of Cyber Risk and Exposure 2025 report, which surveyed 1,000 cyber risk professionals globally, including 150 based in Germany.

19 AI Risk Leaders Driving Enterprise Transformation

‍ AI has moved from experimentation to everyday infrastructure, shaping decisions and workflows across nearly every industry. However, in the rush to harness its speed and efficiency, many enterprises adopted GenAI and other AI systems faster than they built the structures necessary to govern them. The result is an all-too-familiar pattern of powerful technology being deployed widely before its risks are fully understood, let alone managed. ‍

Built for What's Next: How Nucleus Became the Exposure Assessment Platform for a New Era

For nearly a decade, we’ve been building Nucleus with a clear mission: to help security teams make faster, smarter, and more business-aligned decisions about what to fix first. When we started, the world called it vulnerability management. Today, the industry calls it exposure assessment. To us, that evolution isn’t just semantics, t’s the culmination of years spent redefining how organizations understand and reduce risk.

The Hidden Dangers of Calendar Subscriptions: 4 Million Devices at Risk

Day-to-day workload can become overwhelming as time passes alongside the growing tasks and responsibilities of both personal and professional lives. Therefore, a well-structured digital calendar may be an essential organizational tool to navigate through the day, helping with the support we need to manage our time and ongoing commitments.

Flying blind on workforce security? Let User Risk be your co-pilot.

What we heard loud and clear from security teams is that they’re flying blind when it comes to securing their workforce. In fact, companies often have more SaaS applications than they do employees. They just don’t realize it. Secondly, there’s a tremendously long tail of SaaS applications only being used by one person in the organization. Imagine trying to imagine that manually. User Risk, solves this visibility gap by giving organizations visibility into your human risk, enabling safe AI adoption, and driving a security-first culture.

Shadow SaaS IS lurking in your organization. Here's what you need to know.

Is shadow SaaS lurking in your organization? The answer is "yes". Now, what do you do about it? User Risk gives security teams complete visibility into their human risk, enabling safe AI adoption, and driving a security-first culture. Discover more of what User Risk can do for you.

Solving Human Risk: Close the Visibility Gap

The modern cybersecurity landscape is being redefined by the human element. With every individual user accessing your network, tools, and sensitive data, managing your human attack surface is growing more critical than ever. Yet, as user autonomy increases and AI erupts, this task has become increasingly difficult, if not impossible, with yesterday's tools.

Elevating and Evolving the Role of the Channel

Nucleus Manager of Channel Enablement and Training, Tony Ramirez, talks about his recent recognition in CRN's 100 people to know for the channel. During this conversation, he also discusses the evolving role of channel leaders in cybersecurity, the importance of continuous threat exposure management (CTEM) as a process rather than a tool, and the need for contextual understanding in vulnerability management. Tony emphasizes the significance of engaging non-security stakeholders and the opportunities for the channel to educate clients on security posture and vulnerability management.

Attack Surface Discovery: A Quick Overview

Hybrid clouds, rapid development, and Shadow IT have expanded the modern attack surface, making complete visibility both crucial and more difficult than ever. Attack surface discovery offers a means of addressing these visibility gaps by continuously mapping all digital assets — internal, external, and hidden. This guide covers the fundamentals, best practices, and top tools for effectively discovering the attack surface.

Sovereignty in the Age of Digital Interdependence: Rethinking Security for the Modern State

In a world defined by digitization and interconnectivity, the question of sovereignty extends far beyond physical borders. Nations today find themselves grappling with a new reality: how to assert control and protect critical assets when the backbone of their digital existence—cloud infrastructures, distributed systems, and global platforms—operates across jurisdictions, providers, and geopolitical lines.

CISOs turn cyber risk into boardroom business value

Boards now view cybersecurity as a core component of enterprise risk and growth, not just an IT line item. Rising breach costs, regulatory scrutiny, and expanding digital footprints mean directors want to understand how security decisions affect revenue, valuation, and resilience over the long term. For Chief Information Security Officers, that shift creates both pressure and opportunity. The role now includes translating technical risk into clear business impacts, justifying investment with data, and showing how a modern security program protects and even unlocks value across the organization.

Trust Exchange Paid: Scaling Security Communication

Today, Trust Exchange stands tall as a platform used by thousands of customers to communicate their security posture. Now we are introducing the new Trust Exchange Paid tier. This tier is designed to help you eliminate bottlenecks, accelerate deal cycles, and maintain top-tier security communication. For high-growth organizations, scaling communication means that security requests escalate rapidly. With UpGuard’s mission to drive proactive cybersecurity protocols, this is our next step.

Bitsight Threat Intelligence Briefing: Key Malware Trends Shaping Cyber Risk in 2025

The cybercrime underground continues to evolve into a mature, service-based economy that mirrors legitimate technology markets. Threat actors are increasingly adopting professionalized business models, offering malware, access, and data-theft capabilities “as a service” to a broad audience of buyers. During the first half of 2025, Bitsight observed sustained growth in Malware-as-a-Service (MaaS) and Remote Access Trojan (RAT) activity across dark web forums and marketplaces.

How Managed Cybersecurity Services Reduce Risk and Enable Business Growth

Today's organizations of all sizes face increasing pressure to protect sensitive data, maintain compliance, and defend against sophisticated cyberattacks. At the same time, they must continue innovating, scaling, and delivering exceptional customer experiences. This dual mandate-security and growth-can feel at odds for many companies.

How Trusted Partners Reduce Enterprise Risk

Modern enterprises rely on complex ecosystems of cloud providers, software vendors, advisors, and managed service partners. These relationships drive efficiency and help companies move faster, yet they also create exposure. Every integration, shared workflow, or outsourced process introduces a possible weak point. Leaders who want to reduce enterprise risk need partner ecosystems that function as stabilizers rather than additional sources of uncertainty. The goal is to build a network of partners that strengthens resilience and supports long term stability instead of increasing operational fragility.

The Shadow AI Disconnect CISOs Need to Know

Our new State of Shadow AI Report has just uncovered a critical disconnect that all security leaders need to be aware of. We all know shadow AI is exploding, and that blocking is the most logical response. How else are you going to regain control? But our data shows this is backfiring: This is where blocking can get dangerous. It doesn't stop AI; it just limits your visibility. Download the full (ungated) shadow AI report to see all the data.

CVSS Is a Little Bit of Risk: Rethinking CVSS in Vulnerability Prioritization

The best part about my job is that I sometimes get to make some controversial statements. Well, as controversial as things can be in a niche area of cybersecurity like “what is a reasonable measure of vulnerability risk?” Along with my colleague Sander Vinberg we got to explore this question earlier this year at the second Annual VulnCon conference in Raleigh. Even though it’s only been held twice, it is quickly becoming one of my favorite conferences.

Supply Chain Cybersecurity Strategies for Modern Business

The widening attack surface signals a critical risk, and your supply chain is the prime target. Attackers exploit vulnerabilities that were inserted long before the system was onboarded. This enables them to infiltrate data or disrupt systems at any stage, making supply chain attacks a direct and growing risk. A third-party breach compromises your vendor, but a supply chain attack targets you, which is why organizations need to make supply chain cybersecurity a business priority.

Risk Automations: The Shift From Catch-Up to Command

What if your security operations team could reduce the time from risk discovery to resolution, from hours to seconds? 64% of analysts spend more than half of their time on manual tasks. It’s a sobering reality, considering how accelerated detection has become, and the contrast couldn’t be sharper. There are tools that detect zero-day vulnerabilities, map complex attacks, and identify vendor risk exposures, but remediation is still stuck in the age of manual mitigation.

Lookalike Domain Attacks Explained

Your potential customers could be interacting with a malicious website that resembles your company's website. This dangerous cyber risk, known as a lookalike domain, is on the rise, with 80% of registered web domains in 2024 resembling 2000 global brands. This article explains what lookalike domains are, their impact on your brand, and why these attacks are increasing, providing real-time strategies to protect your business from domain spoofing.

Obrela joins the discussion on the future of NATO's cloud security

Drawing on Obrela’s experience managing complex cyber incidents and supporting national-level assurance programmes, Sebastian Bocquier, Head of DFIR, will present a practical, mission-ready framework that shifts accreditation from a static, one-time checkpoint to a continuous assurance capability embedded throughout NATO’s cloud ecosystem.

5G, GPS, and Cyber Risks: The Hidden Security Challenges of Connected Bikes

Technology has transformed the waywe travel. Electric bikes are smarter, faster, and easier to use than ever. From GPS-powered routing to 5G-fueled communicationsystems, these technologies have made traveling more efficient and pleasurable. Still, as I investigated the worldof the electric dirt bike, I found that all this connectivity not only brings convenience but also new security risks that many riders just aren't considering.

How Private Investigators Partner With Ethical Hackers to Uncover Cybercrime

Internet anarchy is quick and at times it seems that the web has a few too many dark corners. Cybercriminals are aware of how to conceal themselves under unrealistic profiles, concealed IP addresses and vanishing messages. Expert strategy is introduced by the private investigators, yet digital trails may become complicated. This is where the ethical hackers come in and with added technical expertise, they manage to figure out the missing traces, lost data and the actual identities. The pair of them form a good team to reveal the truth, record evidence, and safeguard victims.

The Business Case for DSPM: Reducing Risk Through Continuous Visibility

Similar to many other industries today, modern IT is so complex. In the contemporary world, companies are dealing with data within cloud, on-premise, and hybrid environments. This complexity brings about serious security challenges that cannot be solved by conventional security tools. The solution is DSPM (data security posture management); it offers full-time visibility to your data. This will enable you to identify weak spots before an attack. It also assists you in staying secure and compliant and safeguarding your data.

Building the Right Foundation With Kovrr's AI Risk Governance Suite

‍AI systems are being woven into the fabric of business operations at a pace that outstrips the structures needed to safely scale them. McKinsey’s latest State of AI report shows that nearly two-thirds of organizations are still stuck in experimentation or pilot mode, unable to systematically expand AI usage across the business. Although leaders cite early benefits in efficiency, revenue gains, and innovation, only 39% report enterprise-level impact.

Security Alert: CVE-2025-64446 Fortinet FortiWeb Actively Exploited

A critical zero-day, CVE-2025-64446, path-traversal vulnerability in Fortinet FortiWeb, the company’s Web Application Firewall (WAF), is being actively exploited in the wild to create unauthorized administrator accounts on exposed systems. This flaw allows unauthenticated attackers to gain complete administrator access to affected devices.
Featured Post

Cyber Resilience and AI Risk: Safeguarding the UK's Critical Infrastructure in a New Threat Landscape

In October, the UK put a spotlight on cyber resilience with the release of the NCSC's 2025 Annual Review. CEO Richard Horne warned that failing to prepare for cyberattacks risks a company's future. The urgency behind this statement is backed by data: the NCSC handled 204 major cyber incidents between September 2024 and 2025, and 43% of UK businesses reported a breach in the past year.

Why IoT in Your Supply Chain Still Poses a Serious Cyber Risk

In today’s digital economy, every organization—whether a law firm, retailer, or financial services provider—is now part of someone’s critical infrastructure. A dangerous misconception persists: that Internet of Things (IoT) devices and Industrial Control Systems (ICS) are only concerns for industrial or manufacturing sectors. In reality, these technologies are quietly embedded in everyday operations across nearly every industry.

Understanding the MITRE ATT&CK Framework: A Modern Lens on Adversary Behavior

The MITRE ATT&CK framework is one of the most widely adopted and respected resources in the field of cyber threat intelligence. Serving as a common language for security professionals across industries and departments, it provides a consistent and structured way to describe adversary behavior.

Honored to Be Named a Challenger in the 2025 Gartner Magic Quadrant for Exposure Assessment Platforms

We’re proud to share that Nucleus Security has been named a Challenger in the inaugural 2025 Gartner Magic Quadrant for Exposure Assessment Platforms (EAPs) — recognized for our completeness of vision and ability to execute. This marks a significant milestone not only for Nucleus, but for the evolution of our entire industry. For the first time, Gartner has formally recognized Exposure Assessment Platforms as a distinct category.

The Convergence of Threats: Insights from the 2025 ENISA & Microsoft Reports

Muhammed Mayet, Global Sales Engineering Director, at Obrela elaborates on ENISA’s Threat Landscape 2025 and Microsoft’s Digital Defense Report 2025 and discusses how resilience can win over complexity The European Union Agency for Cybersecurity (ENISA), in its Threat Landscape 2025 report, paints a vivid picture of sustained and diverse cyberattacks across the EU.

Human Risk Multiplier: How Mobile Devices Expand Enterprise Attack Surfaces

Modern businesses are more reliant on mobile devices than ever before. Employees need smartphones and tablets for communication, productivity, and even security authentication. As remote and hybrid work setups become more common, mobile technology is necessary for keeping workers connected to their organizations. At the same time, these devices expose a weak link in the cybersecurity chain: the human layer.

Uncovering the Shadow AI Paradox

Does the world really need another study of shadow AI? That was my first thought going into this project. Reading dozens of previous reports did not change that impression: there's a lot of shadow AI out there, and a lot of reports saying so. But the more I read, the more apparent it became that something important was missing. This endless supply was not meeting what was actually in demand.

Unlock resilient growth: Master climate change risk in 2026

Climate change is no longer a distant threat; it has become a defining issue of our time. Rising global temperatures, unpredictable weather patterns, and shifting socio-economic landscapes are reshaping how businesses operate and how governments serve their constituents. In the midst of these enormous challenges, there is one undeniable truth: resilient growth hinges on the capacity to understand, manage, and adapt to climate change risk.

Scaling Exposure Management: Program Maturity and Continuous Optimization

Building an exposure management program is just the beginning of a long journey. True success comes from scaling that program through continuous optimization, measurable progress, and organizational alignment. As enterprises expand their digital footprint, exposure management must evolve from reactive vulnerability remediation to a proactive, data-driven discipline that continuously strengthens resilience.

3 Truths About the Financial Sector's Digital Supply Chain Uncovered by Bitsight TRACE

When it comes to managing cyber risk, the financial sector is squarely at the top of the food chain. It’s simple economics (and the plot of many movies): financial institutions have the money, and cybercriminals are always looking for ways to take it. As a result, institutions have invested heavily in strengthening their internal systems and cybersecurity controls. Those investments have paid off.

It's time to rethink shadow AI.

It's time to rethink shadow AI. We've been told it's a fringe activity. A risk from rogue employees. Our new research proves that wrong. This is, ironically, no longer a "shadow" problem. It's a universal workflow hiding in plain sight. The question is no longer "how do we stop it?" It's "how do we manage it?" Our new report lands next week with the date you need to start answering that important question.

Direct vs. Indirect AI Risks: What Security Teams Need to Know #AIsecurity #AppSec #AInative

AI coding assistants don’t just speed up development — they introduce two kinds of risks you can’t afford to ignore. Direct risks: vulnerabilities added straight into generated code. Indirect risks: exposure through how AI tools shape workflows, dependencies, and external connections. Both can create blind spots — and both demand visibility. Watch to learn how recognizing these layers helps secure your AI-driven workflows.

Critical Care, Critical Risk: Inside the Cyber Threats Targeting Healthcare

The healthcare sector remains one of the most targeted industries for cyber attacks due to its critical role in national infrastructure and its extensive repositories of sensitive data containing personally identifiable information (PII). It’s widely assumed that threat actors target healthcare and related organizations because they are perceived as more likely to pay a ransom to restore critical systems and protect patient safety in the event of an attack.

AI in Cybersecurity: How Smart Attacks Are Redefining Risk - and What Your Brand Must Do

In today’s fast-moving digital world, the adversary has evolved — threats aren’t just more frequent, they’re smarter. Artificial Intelligence (AI) is no longer only a force for good. Threat actors now leverage AI-driven methods to automate attacks, craft human-like deception, and exploit blind spots in organizations relying on outdated defenses.

A CISO's Guide to Defending Against Social Media Impersonation

The platforms your customers trust to connect with your brand are now being weaponized to destroy its reputation. AI is equipping cybercriminals with industrial-scale operations that can replicate your brand presence across all major social platforms in just minutes. This guide provides a CISO's framework for moving from reactive brand monitoring to proactive threat disruption, detailing a four-pillar plan to neutralize these threats before they impact your business.

Cybersecurity Burnout's Secret Trigger: Lack of Visibility

The work of a cybersecurity professional never ends, and it’s never easy. Whether they’re responding to incidents in the SOC or briefing the board on supply chain vulnerabilities, security leaders and practitioners live under constant pressure. And while the reality of burnout may not be new, it’s still a growing threat. One that endangers not only the well-being of security professionals but also the resilience of the organizations they protect.

Elevate Your GRC Game: Automate Risk, Compliance & Resilience | LevelBlue + OneTrust

In today’s evolving world of Governance, Risk, and Compliance (GRC), organizations face new challenges—expanding digital boundaries, data sprawl, manual processes, and a constantly shifting regulatory landscape. “Elevate Your GRC Game” brings together LevelBlue and OneTrust to show how automation and AI can transform these challenges into opportunities. Discover the latest GRC trends—from proactive risk management and business-integrated frameworks to continuous compliance and data governance.