Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why Legal AI Governance Must Operate at the Point of Use

A recent report of a solicitor facing regulatory investigation after uploading client documents into ChatGPT is not an isolated incident. It is a visible symptom of a broader structural issue unfolding across highly regulated industries. Legal professionals operate under strict duties of confidentiality, and yet the tools reshaping their workflows are being adopted faster than governance and operational controls can keep pace. The challenge is not whether AI should be used in legal practice.

Why Threat Actor Context Matters for Cyber Risk Prioritization

Cyber threat intelligence is often presented as a catalog of named threat actors, past incidents, and attribution labels that promise clarity. For defenders trying to understand risk, this structure feels reassuring. It suggests that threats can be identified, tracked, and anticipated based on observed behaviors. In practice, that confidence is often overstated.

Mapping and Managing AI Supply Chain Risk (Featuring Panorays)

-Recent breaches show AI risk is already present in many environments, often entering through suppliers, data flows, and integrations. But awareness alone is not enough. CISOs and security leaders must actively manage the expanded attack surface AI creates. In this session, experts from CyCognito and Panorays help you understand how to identify AI relationships, assess the risks they pose, and remediate vulnerabilities before they lead to an incident. You’ll learn.

5 AI Myths Exposing the Governance Gap

AI adoption isn’t slowing down. It’s accelerating, quietly, unevenly, and often outside formal control. To separate assumption from reality, CultureAI commissioned an independent research study of 300 senior technology, security, and risk leaders across North America and Europe. Respondents included CISOs, CIOs, CTOs, Data Protection Officers, and senior IT and security leaders across finance, healthcare, technology, legal, and professional services.

Live Webinar- Securing Multi-AI Deployments MCP; Agentic AI & Inter-AI Security

live webinar with Aaron Turner, IANS Faculty, who presents findings from his recent IANS research, 7 Steps to Securing Multi-AI Deployments, and explain how security teams can apply proven principles to modern AI systems.

The Vendor Tiering Series: Why Tier Your Vendors

The thing about blanket approaches is that they rarely work or scale. The same holds true for third-party cyber risk management. Treating every provider, stakeholder, or partner with the same intensity is neither productive nor cost-effective. While defaulting to treating every vendor at the same risk level is common, it is not a resilient security strategy.

Beyond Indicators: Gaining Context with Adversary Intelligence

Actions have consequences. In cybersecurity, we often only see actions at the surface level: a suspicious IP, a new domain, or a single mention on a dark web forum. For threat hunters, the consequences of treating these actions as isolated incidents are significant. These signals are rarely "one-offs." They are the visible tips of coordinated campaigns built on months of planning, spanning multiple tactics, techniques, and procedures (TTPs). Today’s adversaries are organized.

Meet Seema: A Simpler Way to Understand Risk

Getting clear answers about your security risk shouldn’t require hours of manual work or deep platform expertise. Meet Seema – Seemplicity’s new AI assistant designed to translate complex remediation data into plain-spoken, actionable insights. Whether you’re a practitioner investigating a specific vulnerability, an engineer needing context on a finding, or a leader briefing on overall risk, Seema provides the clarity you need to move from data to action.

Internet Exposure as a Critical Layer of Context in Vulnerability Management

During a recent video interview, we spent time unpacking a deceptively simple question: what actually makes a vulnerability critical? Severity scores, exploitability, and asset importance all factor into the answer. But one layer of context consistently changes the urgency of a finding more than most teams expect: internet exposure. The difference between a vulnerability that exists and one that matters often comes down to whether an attacker can reach it.

Beyond Access: How Cato Measures and Manages User Risk in Real Time

On a quiet Tuesday morning, Jerry, a fictional system administrator, logged in as usual. While testing a new integration script, he visited a documentation page on an unfamiliar domain. It looked harmless and loaded without issue, but behind the scenes, Jerry’s laptop began making a series of small outbound requests to several low-reputation domains. None of these connections were malicious enough to be blocked, yet the pattern resembled early-stage domain-flux activity.

Permission to Ignore: Leveraging the CTEM Framework to Focus on Real Risk

Security frameworks have always had a gap. They tell you to find vulnerabilities and fix them, but they’ve rarely provided a system to determine which ones actually matter before you tap into your most expensive resource: engineering time. CTEM changes the game by treating security as a continuous lifecycle rather than a series of silos.

Why Patching Cadence Should Be a Risk Priority in 2026

Patching cadence is a critical component of maintaining an organization’s cybersecurity posture. It refers not just to whether patches are applied, but how quickly and consistently vulnerabilities are addressed across systems and software. A regular, timely patching process reduces the window of exposure to known vulnerabilities, limiting opportunities for exploitation and strengthening overall vulnerability management.

How Companies Can Protect Against Third-Party Risk in 2026

As organizations move deeper into cloud ecosystems, automation, AI integrations, and global supply chains, one truth becomes increasingly clear: In 2026, third-party risk is not just an IT concern. It is a business continuity concern, a regulatory concern, and in many industries, a board-level concern. From software vendors and cloud providers to managed services, payment processors, contractors, and niche business tools, every external connection introduces potential exposure.

Human Risk Management and Security Awareness Training

A notable statistic continues to shape the cybersecurity research landscape: the human element remains involved in roughly 60% of all confirmed breaches. That’s according to the 2025 Verizon Data Breach Investigations Report (DBIR), which found that social engineering actions like phishing, pretexting, and credential misuse are consistently intertwined with today’s most common attack paths, even when they are not the first visible technical vector.

Trust in the age of AI for fintech auditors

There is an old saying: Trust, but verify. For Third-Party Risk Management auditors in regulated financial institutions, that principle has never been more relevant. Vendor questionnaires, SOC 2 reports, and annual reassessments are no longer enough. Regulators are moving beyond paper-based oversight and toward operational proof. The new expectation is clear: Show where customer data is actually flowing. Prove that you control it.

How Health Risk Assessments Drive Preventive Care and Lower Long-Term Costs?

Health Risk Assessments are increasingly used to support preventive care planning and population health management across healthcare systems.According to the CDC, chronic and mental health conditions account for the majority of U.S. healthcare spending, which exceeds $4 trillion annually.These assessments help identify risks earlier, when interventions are typically more effective and less resource-intensive.

Vendor Risk Response: What Happens After a Vendor Risk Is Identified?

In today's interconnected business environment, the relationship between organizations and their third-party vendors is crucial. However, it also introduces a range of risks. Vendor risk refers to the potential vulnerabilities or threats that arise from working with external suppliers, service providers, or partners. These risks can manifest in various forms, including data breaches, financial instability, operational disruptions, or non-compliance with regulations. Once a vendor risk is identified, it's essential to understand the steps that need to be taken to manage and mitigate that risk effectively.

What is OpenClaw andAgentic AI? The Security Issues You Need to Be Aware of Now

Over the past several weeks, OpenClaw and MaltBook have exploded across the headlines. Outlets have published stories about AI agents organizing themselves or even acting independently on Moldtbook. SecurityScorecard’s Jeremy Turner, VP of Threat Intelligence & Research and Anne Griffin, Head of AI Product Strategy discuss what OpenClaw is, how agentic AI works, and where the real security issues are based on new research from SecurityScorecard's STRIKE Threat Intelligence team.

A Match Made in Heaven: How Valentine's Day Fuels Seasonal Phishing Attacks

Valentine’s Day runs on emotion. Surprise, urgency, curiosity, trust, love. For threat actors, that combination is hard to beat. Every year in mid-February, security teams see the same pattern. Phishing campaigns pick up. Brand impersonation increases. Fraud attempts follow close behind. It is not because attackers suddenly developed new techniques.

CISA BOD 26-02 and the Next Phase of Vulnerability Management

CISA recently published BOD 26-02, the latest Binding Operational Directive shaping how federal agencies manage cyber risk. While attention often gravitates toward highly visible directives like KEV, this one matters for a different reason: it raises the standard for how lifecycle risk must be tracked and sustained over time. BOD 26-02 is described as guidance on unsupported edge devices, which is accurate but incomplete.

The best risk management software for 2026

For many organizations, risk management is still stuck in the past—reliant on spreadsheets, manual reviews, and static registers that go stale shortly after they’re created. Without clear ownership or automation, treatment plans linger, and accountability slips. Risks remain fragmented across departments, disconnected from business impact and board visibility. ‍ At the same time, emerging threats are evolving faster than ever.

How Cybersecurity Impacts Criminal Defense Today

A phone that will not unlock can stall an entire case before the paperwork is even filed. A cloud account login from a new device can flip the narrative in minutes, because the trail people once chased through witnesses now runs through alerts, access records, and exported chats. That shift is easy to miss until you are the one trying to explain what happened, and you realize the first questions are no longer just "where were you" but "which device," "whose credentials," and "what did the logs record."

Why This Moment Matters: Announcing our Series C Funding

Today, we announced our Series C funding. I want to start by saying thank you to Delta-v Capital and Arthur Ventures for their partnership and conviction in what we’re building. We’re grateful for their support and for the trust they’ve placed in our team. They didn’t invest because Nucleus tells a good story.

Securing the Human Layer: The Evolution of Cyber Attacks | Podcast

In this one-off exclusive podcast, Oliver Simonnet, CultureAI's Lead Cyber Security Researcher, sits down with William Jardine, Director at Reversec, and Richard Moore, CISO at 10x Banking, to explore the evolving realities of cyber resilience, AI adoption, and security leadership in a world where AI-driven workflows are becoming the norm.

Exposed OpenClaw Deployments are Turning Agentic AI Into an Attack Surface: What To Do Next

SecurityScorecard's STRIKE Threat Intelligence team has uncovered tens of thousands of exposed OpenClaw instances, many of which are vulnerable to Remote Code Execution (RCE). These exposed OpenClaw instances leave users and organizations open to attacks. OpenClaw and other agentic AI tools are designed to take actions on a user’s behalf, interact with infrastructure, and move across connected services. That functionality is the appeal. It is also the risk for users around the globe.

AI Governance Suite Enhanced for Operational Oversight and Action

Kovrr's AI Governance Suite, released in November 2025, was designed to help organizations bring structure to how they assess and manage AI risk. Since then, it has been adopted by dozens of CISOs and AI GRC professionals operating in environments where GenAI tools and other AI systems were already embedded into daily business operations. Through their usage and feedback, however, a clear pattern emerged.

CultureAI: AI Security & Governance

CultureAI is an AI security platform that enables organisations to adopt AI safely, confidently, and at scale. In most companies, AI adoption has already happened. Sensitive data is flowing into SaaS applications, shadow AI, and personal accounts, creating compliance, privacy, and data-loss risks that traditional security and governance tools were never designed to address.

How Mobile Access Changes the Way Active Traders Manage Positions

Financial markets move quickly, and timing affects every trading decision. Mobile activity now plays a major role in how markets are accessed. Recent market data shows that nearly 25 percent of total trades on Indian stock exchanges are placed through mobile platforms, highlighting a shift toward on-the-go trading.

Dark Web Intelligence for Supply Chains: From Reactive TPRM to Threat-Led Defense

Modern cyberattacks rarely start where defenders are looking. Instead of targeting the enterprise head-on, attackers increasingly move through sprawling ecosystems of vendors, suppliers, and partners, exploiting trust relationships, weak controls, and delayed visibility.

A January Snapshot: Real-World AI Usage

AI is no longer a fringe productivity experiment inside organisations, it is embedded, habitual, and increasingly invisible. This snapshot from CultureAI’s January usage data highlights how AI is actually being used across everyday workflows, and where risk is forming as a result. Rather than focusing on hypothetical threats or model-level concerns, the findings below surface behavioural signals from real interactions: prompts, file uploads, and context accumulation.

The best TPRM software for 2026

Vendor risk programs often scale faster than the teams that run them. Every new third-party relationship adds security questionnaires, evidence requests, and hours of manual follow-up. When a single vendor review can take 50+ hours, backlogs grow, reviews slow, and critical risks slip through. ‍ At the same time, vendor security postures change constantly.

Bitsight: AI-powered intelligence that outsmarts cyber risk

Bitsight is the global leader in cyber risk intelligence, leveraging advanced AI to empower organizations with precise insights derived from the industry’s most extensive external cybersecurity dataset. With more than 3,500 customers and over 68,000 organizations active on its platform, Bitsight delivers real-time visibility into cyber risk and threat exposure, enabling teams to rapidly identify vulnerabilities, detect emerging threats, prioritize remediation, and mitigate risks across their extended attack surface.

Security Considerations When Deploying AI in Legal Environments

Say a mid-sized law firm discovers that confidential case files, including privileged attorney-client communications, were exposed through an AI tool someone in the office started using without IT approval. The breach goes unnoticed for weeks. By the time they catch it, sensitive data has already been logged on external servers. This nightmare could happen to law firms that rush to adopt AI without proper security frameworks in place.

Internet Exposure and Vulnerability Risk: Why Reachability Changes Everything

In this conversation, Ryan Cribelar, R&D Engineer at Nucleus Security, breaks down why internet exposure is one of the most important layers of context in vulnerability and exposure management. Security teams are flooded with vulnerability data, but not every finding carries the same level of risk. As Ryan explains, whether a vulnerability is reachable from the internet can dramatically change how urgent it really is. Internet exposure shortens the path from discovery to exploitation and often determines whether a vulnerability is theoretical or immediately actionable.

Cybersecurity "Armageddon": Are You Ready?

When it comes to cybersecurity, there’s no such thing as being too prepared. In this clip, Ryan Swimm, Senior Manager, GRC Program from Bitsight explains why "softball" security drills just don't cut it. To truly protect your organization, you need to practice for the worst-case scenario—your own "Armageddon" drill. Inside the Drill: Don't wait for a real crisis to find the gaps in your strategy. Practice for doomsday today!

Using pentest findings to inform insurance risk assessments

Cyber insurance is now a routine part of organisational risk management, particularly for organisations with complex IT estates and growing digital exposure. As cyber incidents continue to drive operational disruption and financial loss, insurers are placing greater emphasis on understanding the true level of cyber risk they are underwriting through insurance risk assessments. For senior IT leaders, this often creates friction.

Agentic AI Security and Regulatory Readiness: A Security-First Framework

AI is getting smarter; instead of just waiting for us to tell it what to do, it's starting to jump in, make its own calls, and get whole jobs done by itself. These independent systems can mess with data, use tools, and talk to people in all sorts of places, often doing things way faster than we can keep an eye on. This means we need a new way to stay safe, one that's all about managing what these AIs do and making sure we can always see what's happening and know who's responsible.

Top 6 Supplier Cyber Risk Assessment Tools for Third-Party Risk Management

Your vendors now sit on your cyber perimeter. A single exploited payroll plug-in can become front-page news overnight. In June 2024, the U.S. Justice Department told prosecutors to ask whether companies monitor third-party partners throughout the contract, not only at onboarding. That shift helped shape our review of six purpose-built platforms built for continuous oversight. In the sections ahead, you'll see how each tool automates vendor monitoring, uses AI to cut analyst effort, and helps you keep up with fast-moving compliance expectations.

Is your vendor data a source of insight-or just more noise?

For many risk and compliance leaders, the reality of Third-Party Risk Management (TPRM) is a mountain of disorganized spreadsheets, overflowing inboxes, and endless PDFs. When an audit is seven days away or the Board asks for a risk posture update, documentation overload becomes a liability. In this video, we explore the transition from vendor chaos to risk clarity. The Challenge.

Automating Cybersecurity Governance: How Bitsight Is Expanding AI-Powered Workflows Across SPM and VRM

Security governance was never meant to be this manual. Yet for most security and third-party risk teams, governance work still means reviewing documents line by line, mapping controls by hand, interpreting evidence subjectively, and repeating the same processes across internal teams, subsidiaries, and vendors. These activities are critical, but they’re also slow, inconsistent, and difficult to scale. At Bitsight, we believe cybersecurity governance should move at the speed of risk.

The Monetary Authority of Singapore (MAS) on AI Risk Governance

‍ ‍The Monetary Authority of Singapore's (MAS) Consultation Paper on Guidelines on Artificial Intelligence Risk Management, released in November 2025, dramatically altered how AI is positioned within the country’s financial supervision. The document states that the proposed Guidelines "set out MAS' supervisory expectations relating to AI risk management in financial institutions (FIs)" (p.3).

Cyber Risk in 2026: From Today's Pressures to Tomorrow's Threats

As we enter 2026, security and risk leaders are navigating a landscape that is both increasingly complex and strikingly familiar. At Bitsight, we have spent the last year listening to our customers, synthesizing insights from the field, and preparing for what lies ahead. In a recent webinar with my colleague Vanessa Jankowski, we explored the forces shaping cyber risk in the year to come.

Critical Vulnerability Alert: CVE-2025-40551 in SolarWinds Web Help Desk

A critical vulnerability (CVE-2025-40551) has been identified in SolarWinds Web Help Desk, a widely used IT service management platform deployed across enterprise and public sector environments to manage support tickets, assets, and internal workflows. Successful exploitation could allow an unauthenticated attacker to execute arbitrary commands on the underlying host system.

Security Control Management: The New Mandate for Risk-Driven Security

Article updated and refreshed February 3rd, 2026. Because the tools you’ve deployed aren’t the same as the ones you’re using. Security teams today aren’t short on tools. Most environments are packed with security controls—spanning email, identity, network, endpoint, and cloud. But despite this abundance, risk remains stubbornly high. Attacks continue to land. Exposure persists. The problem isn’t the absence of controls. It’s the lack of control over the controls.

What Are Moltbot and Moltbook? Why the Agentic AI Frenzy Is a Security Trap

AI agents aren’t taking over. But agentic AI without security is a real problem. Over the last few days, Moltbot and its social platform Moltbook have surged across headlines and social media. Some are calling it a glimpse of artificial general intelligence. Others say AI agents are organizing themselves. That’s not what’s happening. In this video, SecurityScorecard’s Jeremy Turner, VP of Threat Intelligence & Research, breaks down what Moltbot actually is, why this isn’t AGI, and where the real danger lives.

What Physical Site Safety Can Teach Cybersecurity Teams About Risk Management

Cybersecurity is often treated as a purely digital challenge, focused on networks, applications, and protecting sensitive data. However, many of the most effective risk management principles used by cyber security teams already exist in physical environments such as construction sites, industrial facilities, and critical infrastructure.

Manic Monday: A Day in the Life of Threat Hunting

John, a Cyber Threat Intelligence (CTI) analyst, turns to look at his CISO. He seems a bit rattled. John responds, “Yeah. Huge story.” “Massive. The board is worried and wants to know if this puts us at risk. We’re secure, right?” John hesitates.“Let me get back to you on that.” The CISO walks away. John races to his desk.