Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

‍ ‍Most cyber risk quantification (CRQ) platforms ask for trust. They describe their data sources in general terms, display an average annual loss at the top of a screen, and offer nothing in between. Anybody wanting to check the number is asked to accept the connection on expert judgment alone, which is a reasonable thing to decline when the figure is about to support a nine-figure decision.

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announced a major update to its iOS application with the release of version 18.1. The latest release introduces a completely redesigned vault interface utilizing Liquid Glass, support for Apple’s new dual-screen iPhone Duo and powerful automation features that simplify credential management on the go.

Most AI security evaluations start with the tools employees already know about: the sanctioned chatbot, the browser plugin, the approved copilot. The harder inventory of AI tooling sits on endpoints, where coding assistants, desktop agents, and custom Model Context Protocol (MCP) servers read files, query databases, and chain actions with no human approving each step.

When an AI system misfires inside a large company, the question that follows is who was responsible for it. The answer usually lands on the CIO, and frequently the CIO had no part in choosing, approving or deploying the thing that failed. ‍ This gets described as a governance problem, which undersells it. Governance implies a process that exists and performs badly.

Halloween is full of disguises, but a cyberattacker does not need a costume to get inside a Microsoft 365 environment. A stolen password or malicious app consent can be enough. From there, the intruder may appear to be an ordinary user doing ordinary work. That is what makes identity compromise so unsettling: The front door can look perfectly familiar. Phishing can trick users into sharing credentials or granting access.

A customer finds the perfect product, adds it to their cart, and heads to checkout. But instead of completing the purchase, they're asked to create an account, remember another password, or go through a lengthy registration process. A few unnecessary steps can turn a potential sale into an abandoned cart. According to the Baymard Institute, the average online shopping cart abandonment rate is 70.22%.

AI is becoming part of everyday work. Employees rely on services such as ChatGPT and Claude to research, create, and solve problems, while developers increasingly use AI-powered tools like Cursor and coding agents in their development workflows. As employees increasingly rely on AI to work more productively, the AI experience is becoming a critical part of the digital experience IT teams are expected to support.

Eight eMudhra intermediate certificate authority (CA) private keys were compromised after being generated with insufficient randomness. Attackers could use these keys to forge certificates and impersonate legitimate websites or services to clients that still trust them. An attacker able to intercept a connection could potentially read or modify sensitive traffic.

This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. Every physical penetration test starts with the same quiet hope: that somewhere, between the polished lobby, the badge readers, the CCTV domes, and the confident hum of office life, there is a tiny gap no one has noticed.

Prompt injection started as a simple idea during its initial chatbot phase: Tell the model to ignore its instructions and return information in violation of its guardrails. Now, prompt injection attacks can aim at something harder to see: how an agent plans, and how a model reasons and decides which rules apply.