Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

bitsight

AI Integration Security: Why the Biggest Risk Is Not the Model

Mar 31, 2026 By Emma Stevens In BitSight
When people talk about AI security risks, the conversation usually starts with the model. Can it be jailbroken? Can someone get around the guardrails? Can an attacker make it say or do something it should not? Those are fair questions, but they are not the most important ones. The bigger risk is not the model on its own: it’s everything the model is connected to.
Read Post
bitsight

Ransomware with a Twizt: Inside the Phorpiex Botnet

Mar 31, 2026 By Threat Research Team In BitSight
Phorpiex, also known as Trik, is a resilient and long-running botnet with a history dating back to 2011. While it has grabbed some headlines, its sustained presence and adaptability make it a subject of ongoing concern for the cybersecurity community. Phorpiex has consistently demonstrated its capability to evolve, shifting from a pure spam operation to a sophisticated platform.
Read Post
cultureai

AI Adoption Surging in Financial Services - But Control Lagging

Mar 30, 2026 By CultureAI Team In CultureAI
Artificial intelligence is moving rapidly from experimentation into everyday use across financial services. From client servicing and research to operations and risk analysis, AI is increasingly embedded in core workflows. This shift is widely recognised within the industry. Recent research indicates that 67% of financial services organisations report rapid AI adoption, with 93% ranking AI as a top security priority heading into 2026. At the same time, governance structures are being established.
Read Post

SecurityScorecard's Weekly Brief: the RSAC 2026 and TITAN AI Edition

Mar 27, 2026 By SecurityScorecard In SecurityScorecard
This is SecurityScorecard's Weekly Brief: the RSAC 2026 and TITAN AI Edition. This week, SecurityScorecard unveiled TITAN AI upon touchdown at RSAC 2026 in San Francisco. The new platform is pioneering the modern era of TPRM, leveraging AI, enhanced threat intelligence, and continuous monitoring to deliver measurable supply chain resilience to customers.
View Video
sedara

What the Stryker Cyber Incident Reveals About Todays Risk, Visibility, and Hardening

Mar 27, 2026 By Liz Sujka In Sedara
In March 2026, Stryker Corporation experienced a global cyber incident that disrupted operations across its environment. Manufacturing slowed, internal systems went offline, and employees were instructed to disconnect devices. At first glance, it looked like another large-scale cyberattack. It wasn’t. This incident exposed a much more important reality about modern cybersecurity risk: organizations are no longer being breached in traditional ways.
Read Post
cultureai

RSA 2026: The Shift Toward Security FOR AI

Mar 27, 2026 By CultureAI Team In CultureAI
RSA Conference 2026 made one thing clear very quickly. Security leaders are done with generic AI pitches. After two years of relentless “AI everything,” the market is now pushing back. There is a growing fatigue with vague promises, surface-level features, and what many are calling outright AI washing. The result is a trust gap. What cut through this year was not another AI-powered detection claim. It was a much more grounded question.
Read Post
bitsight

The 2026 Ratings Algorithm Update: Strengthening Accuracy and Stability

Mar 26, 2026 By Ariela Silberstein In BitSight
Each year, the threat environment changes, and the way we measure cyber risk has to keep up. Attackers adjust quickly. At the same time, organizations add cloud services, SaaS applications, and third parties to their environments. That makes it harder to maintain a stable, external measure of security performance. At Bitsight, the Ratings Algorithm Update (RAU) is one of the major initiatives that helps keep the Bitsight Security Rating a reliable indicator of security performance.
Read Post
knowbe4

Why Your Human Risk Management Strategy Can't Ignore AI

Mar 25, 2026 By KnowBe4 Team In KnowBe4
AI isn’t just another technology wave—it’s a force multiplier for both innovation and risk. In a recent webinar featuring insights from Bryan Palma and guest speaker Jinan Budge, Vice President and Research Director at Forrester, one message came through clearly: the rise of AI and AI agents is fundamentally reshaping the human risk landscape—and security leaders need to move fast to keep up.
Read Post
cyberhaven

Top Generative AI Security Risks In The Enterprise

Mar 25, 2026 By Cyberhaven In Cyberhaven
Enterprise security teams spent years building data loss prevention (DLP) programs around a predictable set of egress channels: email, USB drives, cloud storage, and sanctioned SaaS apps. Generative AI has rewritten those assumptions almost overnight. Today, the same data those DLP controls were built to protect is flowing into AI interfaces that most organizations have no visibility into and no enforcement capability over.
Read Post
bitsight

Major Security Event: Supply Chain Compromise in LiteLLM Versions 1.82.7 and 1.82.8

Mar 25, 2026 By Emma Stevens In BitSight
A supply chain compromise that impacted the Python package LiteLLM, with malicious versions 1.82.7 and 1.82.8 was published to PyPI on March 24, 2026. Bitsight Threat Intelligence, public reporting and vendor disclosures indicate the malicious releases included credential harvesting, Kubernetes-focused lateral movement, and persistence mechanisms, creating serious risk for cloud-native and AI-related environments that installed or ran the affected versions.
Read Post
nucleus

The 9 Essential Requirements for an Enterprise Vulnerability Management System

Mar 25, 2026 By Doug Drew In Nucleus
The fastest way to reduce risk at enterprise scale is to standardize on a vulnerability and exposure management platform that unifies asset visibility, prioritizes what matters, and automates workflow to remediate. In this article, we’ll break down the nine essential requirements security leaders should insist on when evaluating an enterprise vulnerability management system, whether it’s an existing tool in their tech stack or a potential new capability.
Read Post
cultureai

The AI Control Gap: Why Partners Are Now on the Front Line

Mar 24, 2026 By CultureAI Team In CultureAI
For channel partners, AI has quickly moved from a future conversation to a current customer problem. Clients are already using AI across their organisations, often faster than governance can keep up. What’s emerging is not just another technology trend, but a new class of risk that customers cannot fully see or control. Our latest research, based on insights from senior security leaders in highly regulated industries, highlights the scale of the issue.
Read Post
CrowdStrike

CrowdStrike Advances CNAPP with Industry-First Adversary-Informed Risk Prioritization

Mar 24, 2026 By Jason Williams In CrowdStrike
Interest in cloud-native application protection platforms (CNAPPs) has exploded over the recent years, partly due to their ability to reduce alert noise by translating siloed misconfigurations into correlated, theoretical attack paths and exposures. While many organizations have adopted these solutions in pursuit of outcomes like zero critical issues, cloud breaches continue to rise.
Read Post
kovrr

The Next Step in Cyber Risk Management: Decision Simulation

Mar 24, 2026 By Kovrr In Kovrr
‍At its root, cyber risk management is essentially a forward-looking discipline. The goal has never been solely to understand current exposure, but to determine which actions will reduce it most effectively, given the organization's priorities and constraints. Organizations today can assess control maturity and quantify financial exposure with increasing precision, giving security and GRC leaders a more comprehensive picture of their risk landscape than ever before.
Read Post
How Connected Vehicles and AI Are Redefining Insurance and Digital Security Risks

How Connected Vehicles and AI Are Redefining Insurance and Digital Security Risks

Mar 24, 2026 By SecuritySenses In SecuritySenses
The way we drive is changing. Cars are no longer just machines that take us from one place to another. They are now connected systems that collect data, communicate with networks, and use artificial intelligence to improve safety and performance. These connected vehicles are transforming industries like insurance and cybersecurity in ways we are only beginning to understand.
Read Post
bitsight

The Hidden Third-Party Risks Behind Domain Hijacking

Mar 23, 2026 By Emma Stevens In BitSight
Domains are foundational to digital trust. You visit your favorite online store or log in to your email without thinking twice about the web address in your browser. But what happens if that domain has been hijacked and you have just entered your personal information into an attacker’s trap?
Read Post
fidelis security

How Can Organizations Perform Hybrid Infrastructure Risk Assessment Effectively?

Mar 23, 2026 By Fidelis Security In Fidelis Security
Most organizations didn’t design their infrastructure to become hybrid. It happened gradually. A few workloads moved to the cloud first. Development teams adopted new services. Meanwhile, some systems stayed exactly where they were — inside internal data centers — because moving them wasn’t practical. Over time the environment expanded. Now many organizations run applications across cloud platforms, private infrastructure, and on-premise systems at the same time.
Read Post
safeaeon

Mitigating Risks: Effective Hybrid Cloud Security Strategies for Businesses

Mar 20, 2026 By SafeAeon Inc. In SafeAeon
As businesses increasingly adopt hybrid cloud environments to gain flexibility and scalability, ensuring their security becomes a top priority. The hybrid cloud mixes resources from both public and private clouds, making operations more efficient than ever. But this connected design also poses significant risks, including data breaches, misconfigured systems, and unauthorized access. According to new studies, 82% of businesses had security incidents in their cloud environments in 2023.
Read Post
bitsight

From Risk to Resilience: A New Standard for Security Posture Management

Mar 19, 2026 By Miguel Reis In BitSight
For years, security leaders were asked a simple question: are we secure? Today, that question is harder to answer. Boards, regulators, insurers, and customers want proof of resilience: assurance that organizations understand their exposure, are prioritizing the right work, and are reducing risk over time.
Read Post
nucleus

Why More AI Doesn't Guarantee Better Vulnerability Management Outcomes

Mar 19, 2026 By Will Gorman In Nucleus
AI is everywhere in vulnerability management right now. Technology vendors in all areas are adding new features and making bold claims about revolutionary capabilities. But here's the reality, especially for vulnerability and exposure management: more AI doesn't automatically mean less risk. The gap between AI's promise and its practical impact in enterprise vulnerability management is wider than most organizations realize.
Read Post
cultureai

6 Strategic Implications of AI for Security Leaders in 2026

Mar 19, 2026 By CultureAI Team In CultureAI
There is a structural shift happening in enterprise environments that most security leaders recognise, but few have fully adapted to. AI is now embedded, decentralised, and operating across core workflows. At the same time, governance models are still largely built on assumptions that no longer hold: that tools are known, data flows are observable, and behaviour follows policy. The result is a widening gap between perceived control and operational reality.
Read Post
jfrog

From Agentic Risk to Agentic Confidence: The JFrog MCP Registry is GA

Mar 18, 2026 By Ran Romano In JFrog
In an AI-native world where Model Context Protocol (MCP) is the universal standard for AI connectivity, the security and governance stakes have never been higher. AI’s ability to take autonomous action through MCPs means that a single breach of an MCP server can grant attackers control over mission-critical enterprise systems, putting enterprises in an immediate and escalating state of agentic risk that cannot be ignored.
Read Post
AI Risk Isn't Just About Models. It's About Systems.

AI Risk Isn't Just About Models. It's About Systems.

Mar 18, 2026 By SecuritySenses In SecuritySenses
Most discussions about AI risk focus on the models themselves. Hallucinations. Bias. Data leakage. Unpredictable outputs. These are real concerns. But they only tell part of the story. Because in practice, AI doesn't operate in isolation. It operates inside systems - and that's where the real risk begins to emerge.
Read Post
bitsight

Are AI Security Tools the New EDR? Attackers Are Treating Them That Way

Mar 17, 2026 By Emma Stevens In BitSight
AI security tools are no longer just defensive layers. They are high value targets being studied, fingerprinted, and bypassed much like traditional endpoint detection and response (EDR) platforms and antivirus solutions were in their early days. The speed and scale at which these tools are being deployed makes reactive defense increasingly unsustainable.
Read Post
veracode

Tackling Third-Party Risks: The Persistent Software Supply Chain Challenge

Mar 17, 2026 By Natalie Tischler In Veracode
Modern software development relies on open-source components to accelerate innovation. This efficiency, however, introduces significant risk. Your application’s security is now tied to a vast and complex supply chain of code you did not write. The persistent software supply chain challenge is that this external code is a primary source of critical vulnerabilities and a hard.
Read Post
veriato

Proactive Insider Risk Management: The Smartest Cybersecurity Investment for 2026

Mar 13, 2026 By Veriato Team In Veriato
One reality that organizations must accept in 2026 is that insider risk can no longer be a secondary security concern. It is a material business risk with direct implications for governance, operational resilience, and enterprise value. Source: 2025 Cost of Insider Risks Global Report by Ponemon Institute.
Read Post
kovrr

What Data Is Required for EU AI Act Compliance

Mar 12, 2026 By Kovrr In Kovrr
The EU AI Act places significant emphasis on documentation because regulatory oversight depends on an organization's ability to demonstrate how its AI systems operate and how associated risks are managed. Compliance is not determined solely by how an AI system performs, but by whether the organization can provide evidence that appropriate governance, risk controls, and oversight mechanisms are in place throughout the system lifecycle.
Read Post
The Hidden Security Risks Living Inside Your APIs

The Hidden Security Risks Living Inside Your APIs

Mar 12, 2026 By SecuritySenses In SecuritySenses
Most organisations spend serious money on firewalls, endpoint protection, and threat monitoring. Yet one of the most commonly exploited attack surfaces gets far less attention: the APIs quietly running underneath almost every modern application. APIs are the connective tissue of today's digital infrastructure. They allow apps to talk to each other, enable third-party integrations, and power the real-time data exchanges that businesses depend on daily. They are also a favourite target for attackers who know that many organisations have not secured them properly.
Read Post
vanta

Best GRC software solutions for 2026

Mar 11, 2026 By Vanta In Vanta
The right GRC platform does more than help you check boxes. As compliance requirements grow and security threats become more complex, Governance, Risk, and Compliance (GRC) software is essential for protecting your organization, enabling proactive risk management, and building stronger resilience. ‍ In this article, we review five of the best GRC solutions, highlighting their key features, strengths, limitations, and use cases, to help you pick the right tool for your organization. ‍ ‍
Read Post
bitsight

RondoDox Botnet: From Zero to 174 Exploited Vulnerabilities

Mar 11, 2026 By João Godinho In BitSight
According to a 2024 report from IoT Analytics, there were 16.6 billion Internet of Things (IoT) connected devices at the end of 2023, and that number is expected to grow to 41.1 billion by 2030. This means an increased attack surface for malicious actors to take advantage of, especially given that the security posture of the vendors that provide these devices varies greatly.
Read Post
upguard

The Vendor Tiering Series: Tiering that Scales

Mar 11, 2026 By Revashni Moodley In UpGuard
There’s no way to stop the clock in cybersecurity for InfoSec teams, but you can find ways to manufacture a better way to spend their time. Tiering does just that, prioritizing your team’s most finite resource. But to start, you need better data, and most importantly, better logic to redefine how you work.
Read Post
cyberhaven

Now Available: Cyberhaven's Free AI App Risk Checker

Mar 10, 2026 By Cyberhaven In Cyberhaven
Most security teams are being asked to "enable AI" before they have any real sense of which tools are safe to use. That gap is costing them. Cyberhaven's research found that the majority of AI tools in active enterprise use today fall into high or critical risk categories, and more than 80% of enterprise data flowing into AI is going to those risky tools, not to platforms built with serious security in mind. To help security teams cut through the noise, we built the Cyberhaven AI App Risk Checker.
Read Post
levelblue

The 6 Steps Organizations Should Immediately Take to Mitigate Quantum-Related Risk

Mar 10, 2026 By Lynn Burns In LevelBlue
Quantum computing is an emerging technology that presents significant data security risk to global organizations that rely on quantum vulnerable encryption algorithms, systems, and infrastructure. The threat isn’t theoretical. The risk of quantum-enabled attacks will fundamentally reshape how organizations encrypt their data, design their digital trust infrastructure, and maintain agility in production cryptographic systems.
Read Post
bitsight

Connected Vehicles, Accelerating Risk: Inside the Cyber Threats Facing Automotive

Mar 10, 2026 By Emma Stevens In BitSight
The automotive industry is changing faster than ever, with smarter factories, connected vehicles, digital supply chains, and software-driven everything. But as the industry accelerates into this new era, something else is racing alongside it: cyber threats. Over the past year, Bitsight Threat Intelligence data has shown a sharp rise in ransomware activity targeting companies across the auto ecosystem. And what’s striking is how often the same names keep appearing.
Read Post

Beyond Human Scale: The Shift to Machine-Speed Defense

Mar 6, 2026 By UpGuard In UpGuard
Modern threats move faster than humans can process. Join UpGuard CISO Phil Ross to discover how to replace manual bottlenecks with a machine-speed operating system for risk that orchestrates vendor, human, and attack surface defenses into one unified strategy. Interested in finding out more about UpGuard?
View Video
nucleus

Exposure Assessment Platforms Are Here and They're a Big Part of Successful CTEM

Mar 5, 2026 By Rob Gibson In Nucleus
Gartner released its 2025 Magic Quadrant for Exposure Assessment Platforms in November 2025. The new categorization detailed in the report is something we view as a natural progression in response to the way enterprise risk has evolved over the years. It’s a move away from viewing vulnerabilities in a vacuum and looking at a more complete picture of the risk today’s enterprises face.
Read Post
kovrr

EU AI Act Compliance Explained for CISOs and GRC Leaders

Mar 5, 2026 By Kovrr In Kovrr
‍The European Union's Artificial Intelligence Act (EU AI Act) represents the first comprehensive attempt by a major regulator to establish legal oversight of artificial intelligence. Its objective is to ensure that AI systems deployed across the EU operate safely, transparently, and in a manner that protects fundamental rights.
Read Post

Why AI Features Don't Equal Better Vulnerability Management

Mar 4, 2026 By Nucleus Security In Nucleus
AI is becoming table stakes in vulnerability and exposure management. In this candid webinar conversation, Chris Ray, Field CTO at GigaOm, and Will Gorman, CTO and leader of AI initiatives at Nucleus Security, challenge the assumption that more AI automatically leads to better outcomes.
View Video
upguard

The Vendor Tiering Series: Mapping Tiers to Inherent Risk

Mar 4, 2026 By Revashni Moodley In UpGuard
Cybersecurity doesn’t really have quiet days. Usually, it’s just long stretches of constant noise before realizing you’ve been blindsided. That blindside is a flat list of unprioritized vendors. Without a way to filter what matters when a team needs to mitigate the fallout of a crisis, a vendor inventory like this becomes a compliance-only activity that offers a false sense of security.
Read Post
bitsight

Why Infostealers Are Central to Third-Party Breaches: A Look at the Top Malware Targeting Your Vendors

Mar 4, 2026 By Emma Stevens In BitSight
When threat actors compromise your vendors, they are rarely aiming for a single, isolated win. They are looking for leverage. Every third party represents a potential force multiplier: a trusted connection, a shared platform, a pathway into multiple downstream environments. We recently looked at the vulnerabilities that are most commonly being used against vendors, but vulnerabilities alone don’t tell the full story.
Read Post
bitsight

OPC UA Exposure Snapshot: A Year in Review of Internet-Facing Devices

Mar 3, 2026 By Vasco Pinto In BitSight
Over the past year, Bitsight TRACE has identified 14,220 unique internet-exposed Open Platform Communications Unified Architecture (OPC UA) servers globally. Given OPC UA's critical role as a communication backbone for modern industrial control systems (ICS) across numerous sectors, this level of exposure warrants a closer look. Our analysis reveals that over half (51.74%) of these devices allow unauthenticated access, while 80.26% transmit data in plaintext without encryption or integrity protection.
Read Post
kovrr

Integrating Cyber Risk Into Enterprise Risk Frameworks

Mar 3, 2026 By Kovrr In Kovrr
‍ ‍Cyber risk management plays a foundational role in enabling business resilience. As organizations today rely more heavily on digital infrastructure than ever before, the world's cyber threats have direct implications for operational continuity and revenue stability. The ability to manage these risks proactively, therefore, determines how well a company can absorb disruption and maintain performance under pressure.
Read Post
bitsight

How Early Signals Surfaced by Dark Web Intelligence Enhance Supply Chain Cyber Resilience

Mar 2, 2026 By Chris Klinchik In BitSight
Organizations are facing a complicated and unwieldy cybersecurity perimeter due to the sprawling web of third-party dependencies that now account for 30% of all data breaches. This network of interconnected applications and infrastructure gives threat actors an opportunity through an extended attack surface to exploit organizations. Attackers are also moving faster by leveraging AI to weaponize zero-day vulnerabilities in days rather than weeks, and most organizations remain dangerously behind the curve.
Read Post
levelblue

LevelBlue Security Colony Vendor Assessment: Know Your Vulnerabilities Before Others Do

Mar 2, 2026 By LevelBlue In LevelBlue
Self-evaluation in any area, especially cybersecurity, can be difficult, but in an age when supply chains are long and third-party attacks are common, understanding your vendor’s cybersecurity posture is key. To address this cybersecurity challenge, LevelBlue Security Colony, a service founded under the legacy Trustwave brand, offers a Vendor Risk Assessment tool. It enables organizations to hold a mirror up to their online presence and see how it appears to others, particularly threat actors.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.